Still a scripting noob

Looking for help from the group. I have this script that does a great job of returning data using get-acl. The manager I gave the output to wants me to add aduser information like company, department etc... so that the resulting list of users might be easier to find. I'm a scripting noob although I've been trying to teach myself for years.

 This script creates a csv file listing top level folder permissions in a folder.

 $OutFile = "c:\results.csv"
 $Header = "Folder Path,IdentityReference,AccessControlType,IsInherited,FileSystemRights"
 Del $OutFile
 Add-Content -Value $Header -Path $OutFile

 $maxdepth = 1
 $RootPath = "E:\shared\daily collection"
 $actual_depth_param = [int]([regex]::Matches($RootPath, "\\")).count + [int]$maxdepth + 1
 $Folders = dir $RootPath -recurse | where {$_.psiscontainer -eq $true}

 foreach ($Folder in $Folders){
 if (([regex]::Matches($Folder.fullname, "\\")).count -lt $actual_depth_param) {
 $ACLs = get-acl $Folder.fullname | ForEach-Object { $_.Access }
 Foreach ($ACL in $ACLs){
 $OutInfo = $Folder.Fullname + "," + $ACL.IdentityReference + "," + $ACL.AccessControlType + "," + $ACL.IsInherited+ "," + $ACL.FileSystemRights
 Add-Content -Value $OutInfo -Path $OutFile
 }}}


 $acl.AccessControlType


 Thanks in advance for your help.

Boston49
Boston49Asked:
Who is Participating?
 
Chris DentConnect With a Mentor PowerShell DeveloperCommented:
Good morning,

This is untested, no Active Directory here for me to contemplate testing it against :)

It's commented throughout, but this is a good bit more complex than your original.

# You need RSAT installed to be able to import this. 
# There are alternatives if this doesn't work for you.
Import-Module ActiveDirectory

$RootPath = "E:\shared\daily collection"
$OutFile = "c:\results.csv"

# Killing the -recurse flag, slows us down.
# Storing all of this in a variable so we can add to the output afterwards
$AccessReport = Get-ChildItem $RootPath | Where-Object { $_.PsIsContainer } | ForEach-Object {

  # Drop down into th esecond level of folders
  Get-ChildItem $_.FullName | Where-Object { $_.PsIsContainer } | ForEach-Object {

    # Hold this for a moment so we can construct and output object
    $FullName = $_.FullName

    # Build the output object based on the Access property from Get-Acl
    # @{Name=...;Expression={ ... }} describes a custom property we're adding to the output.
    Get-Acl $FullName | Select-Object -ExpandProperty Access | Select-Object`
      @{Name='Folder Path';Expression={ $FullName }},
      IdentityReference,
      AccessControlType,
      IsInherited,
      FileSystemRights
  }
}

# Users may appear more than once in a report, if we first pick out a unique list of users we can
# minimise the work we must do against Active Directory. That's a very good thing.
$IdentityList = $AccessReport | 
  Where-Object { $_.IdentityReference.Value -notmatch '^(BUILTIN|NT AUTHORITY)' } |
  ForEach-Object { $_.IdentityReference.Value -replace '^.+\\' } |
  Select-Object -Unique

# A hashtable (key / value list) will be used to store the results we get from AD
$ADObjects = @{}
$IdentityList | ForEach-Object {
  $ADObject = Get-ADUser -LdapFilter "(sAMAccountName=$_)" -Properties Company, Department, Description

  # Test to see if we found anything
  if ($ADObject) {
    # Store what we found in the hashtable. We'll use this again in a minute.    
    $ADObjects.Add($_, ($ADObject | Select-Object Company, Department, Description))
  }
}

# Time to combine the results
$AccessReport | ForEach-Object {
  $Identity = $_.IdentityReference.Value -replace '^.+\\'

  # See if we found a result for this above
  if ($ADObjects.Contains($Identity)) {
    # Add the new fields to the original object we created for the report
    $_ | Select-Object *,
      @{n='Company';e={ $ADObjects[$Identity].Company }},
      @{n='Department';e={ $ADObjects[$Identity.Department }},
      @{n='Description';e={ $ADObjects[$Identity.Description }} 
  }

# Finally, it's time to drop it all back to a file.
} | Export-Csv $OutFile -NoTypeInformation

Open in new window


Please yell if you have questions about the snippet above.

Cheers,

Chris
0
 
Boston49Author Commented:
A bit more explanation if you need it. For each IdentityReference returned, I'd like to also get acluser information like Company and Description as well. Thanks again.
0
 
Boston49Author Commented:
Thank you yes this is a powershell script. Missed that.
0
What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

 
RobSampsonCommented:
Hi, I'm not that big on Powershell myself, but this article shoud give you some idea on which methods you need to use, based on your IdentityReference.

If you need me to I might be able to test a bit later on.

Rob
0
 
Boston49Author Commented:
Agreed. I had tried to do that earlier, just realized how to... Thanks.
0
 
Boston49Author Commented:
This answer got me on the right track. I now have added the required information to my report. Thanks!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.