Solved

Powershell script - set folder permissions

Posted on 2011-09-02
4
1,741 Views
Last Modified: 2012-05-12
I have a Windows 2008 file server. I have the following share
D:\Folder1 > this folder is shared to domain users with "list folder contents only"
Reason: Directory structure inside Folder1 is company standard.

Inside D:\Folder1

\UserFolder1
\UserFolder2
\UserFolder3
.
.
.
\UserFolder200

Permissions to be set on each subfolder: disallow inheritable permissions from parent. Then set the modidy permission for each folder.


So i found this powershell script to do this. However i cant seem to understand what could be inside c:\folders.txt. i am thinking it could be some kind of permission statement

Also can you explain the foreach loop?

I am learning powershell now and i have had to refresh my mind scripting which i havent done in a long time.

Script:
===============================

for ($i=1;$i-le200;$i++)
{
New-Item ('c:\Folder1\UserFolder' + $i) -type directory
}

$Users = Get-Content 'C:\Folders.txt'

# grabs the ACL from the model folder created to duplicate acl to folders 1-200
$acl = Get-Acl ('C:\Folder1\Model')

ForEach ($user in $users)
{
      $newPath = Join-Path "C:\Folder1\" -childpath $user
      $acl | Set-Acl $newPath
}
0
Comment
Question by:lurezero
4 Comments
 
LVL 8

Expert Comment

by:brittonv
ID: 36473527
for each item in folders.txt it will store it as $user and use it in each pass

so if folders.txt contained:
apples
oranges

the first time in the foreach loop
$users will be apples
second time $users will be oranges
...
0
 

Author Comment

by:lurezero
ID: 36473717
so i am guessing the folders.txt contains a list of users? or group?

what would be the syntax?
0
 
LVL 16

Expert Comment

by:Bryan Butler
ID: 36474176
Yes.  List of users login IDs.  Just one per line:

User1ID
User2ID
etc...
0
 
LVL 16

Accepted Solution

by:
Dale Harris earned 500 total points
ID: 36474267
The script you pulled up is to create a special list of folders based on users, so the place where it says "Home Directory" in AD, is where their home folder would be.

Example:

John.smith has a user account.

In the shared drive, it creates a folder for him called john.smith and applies permissions for him.

That's not what you're looking for.

You're going to want a "model" folder set up the way you want and pull the ACL from there and apply it to the subsequent folders.

Example:

I have a folder in my C:\ called Test.  Here's the gci -recurse of that folder:

PS C:\test> gci -recurse


    Directory: C:\test


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder
d----          9/2/2011   9:50 AM            model


    Directory: C:\test\ExampleFolder


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder1
d----          9/2/2011   9:51 AM            NewExample
d----          9/2/2011   9:51 AM            _2


    Directory: C:\test\ExampleFolder\_2


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----          9/2/2011   9:51 AM            ExampleFolder1
d----          9/2/2011   9:51 AM            _2NewExample

You can see there are multiple folders within folders (no files).

We are going to do our first command against the "model" folder, or the folder that I've set to not receive inheritable permissions.  You can also set up permissions on that model folder for people like "domain admin" "users" "company 1 users" "company 2 users", etc so that it will make a mirror on all the folders in a given directory.  If you want to make sure you do only folders, we can do that too.

The other folders I've confirmed already have inheritable permissions set as true.

$ACL = get-acl "c:\test\model"

#Now we are going to set this ACL example we have on all the subsequent files and folders

gci -recurse c:\Test\ExampleFolder | %{set-acl -aclobject $ACL $_.fullname}
#If you want to apply only to folders, do this instead
gci -recurse c:\Test\ExampleFolder | ?{$_.psiscontainer} |%{set-acl -aclobject $ACL $_.fullname}

Now when I go to each folder, the permissions have changed only slightly.  Now they are not inheriting permissions and anything on the "model" folder has been overwritten to the permissions of the folder.

Warning: tested on a Windows 7 box, not on a Windows Server 2008 environment.  Please test this out first on a test environment, don't mess with production.

HTH,

Dale Harris
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Synchronize a new Active Directory domain with an existing Office 365 tenant
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…

860 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question