Still a scripting noob

Looking for help from the group. I have this script that does a great job of returning data using get-acl. The manager I gave the output to wants me to add aduser information like company, department etc... so that the resulting list of users might be easier to find. I'm a scripting noob although I've been trying to teach myself for years.

 This script creates a csv file listing top level folder permissions in a folder.

 $OutFile = "c:\results.csv"
 $Header = "Folder Path,IdentityReference,AccessControlType,IsInherited,FileSystemRights"
 Del $OutFile
 Add-Content -Value $Header -Path $OutFile

 $maxdepth = 1
 $RootPath = "E:\shared\daily collection"
 $actual_depth_param = [int]([regex]::Matches($RootPath, "\\")).count + [int]$maxdepth + 1
 $Folders = dir $RootPath -recurse | where {$_.psiscontainer -eq $true}

 foreach ($Folder in $Folders){
 if (([regex]::Matches($Folder.fullname, "\\")).count -lt $actual_depth_param) {
 $ACLs = get-acl $Folder.fullname | ForEach-Object { $_.Access }
 Foreach ($ACL in $ACLs){
 $OutInfo = $Folder.Fullname + "," + $ACL.IdentityReference + "," + $ACL.AccessControlType + "," + $ACL.IsInherited+ "," + $ACL.FileSystemRights
 Add-Content -Value $OutInfo -Path $OutFile
 }}}


 $acl.AccessControlType


 Thanks in advance for your help.

Boston49
Boston49Asked:
Who is Participating?
 
Chris DentPowerShell DeveloperCommented:
Good morning,

This is untested, no Active Directory here for me to contemplate testing it against :)

It's commented throughout, but this is a good bit more complex than your original.

# You need RSAT installed to be able to import this. 
# There are alternatives if this doesn't work for you.
Import-Module ActiveDirectory

$RootPath = "E:\shared\daily collection"
$OutFile = "c:\results.csv"

# Killing the -recurse flag, slows us down.
# Storing all of this in a variable so we can add to the output afterwards
$AccessReport = Get-ChildItem $RootPath | Where-Object { $_.PsIsContainer } | ForEach-Object {

  # Drop down into th esecond level of folders
  Get-ChildItem $_.FullName | Where-Object { $_.PsIsContainer } | ForEach-Object {

    # Hold this for a moment so we can construct and output object
    $FullName = $_.FullName

    # Build the output object based on the Access property from Get-Acl
    # @{Name=...;Expression={ ... }} describes a custom property we're adding to the output.
    Get-Acl $FullName | Select-Object -ExpandProperty Access | Select-Object`
      @{Name='Folder Path';Expression={ $FullName }},
      IdentityReference,
      AccessControlType,
      IsInherited,
      FileSystemRights
  }
}

# Users may appear more than once in a report, if we first pick out a unique list of users we can
# minimise the work we must do against Active Directory. That's a very good thing.
$IdentityList = $AccessReport | 
  Where-Object { $_.IdentityReference.Value -notmatch '^(BUILTIN|NT AUTHORITY)' } |
  ForEach-Object { $_.IdentityReference.Value -replace '^.+\\' } |
  Select-Object -Unique

# A hashtable (key / value list) will be used to store the results we get from AD
$ADObjects = @{}
$IdentityList | ForEach-Object {
  $ADObject = Get-ADUser -LdapFilter "(sAMAccountName=$_)" -Properties Company, Department, Description

  # Test to see if we found anything
  if ($ADObject) {
    # Store what we found in the hashtable. We'll use this again in a minute.    
    $ADObjects.Add($_, ($ADObject | Select-Object Company, Department, Description))
  }
}

# Time to combine the results
$AccessReport | ForEach-Object {
  $Identity = $_.IdentityReference.Value -replace '^.+\\'

  # See if we found a result for this above
  if ($ADObjects.Contains($Identity)) {
    # Add the new fields to the original object we created for the report
    $_ | Select-Object *,
      @{n='Company';e={ $ADObjects[$Identity].Company }},
      @{n='Department';e={ $ADObjects[$Identity.Department }},
      @{n='Description';e={ $ADObjects[$Identity.Description }} 
  }

# Finally, it's time to drop it all back to a file.
} | Export-Csv $OutFile -NoTypeInformation

Open in new window


Please yell if you have questions about the snippet above.

Cheers,

Chris
0
 
Boston49Author Commented:
A bit more explanation if you need it. For each IdentityReference returned, I'd like to also get acluser information like Company and Description as well. Thanks again.
0
 
Boston49Author Commented:
Thank you yes this is a powershell script. Missed that.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
RobSampsonCommented:
Hi, I'm not that big on Powershell myself, but this article shoud give you some idea on which methods you need to use, based on your IdentityReference.

If you need me to I might be able to test a bit later on.

Rob
0
 
Boston49Author Commented:
Agreed. I had tried to do that earlier, just realized how to... Thanks.
0
 
Boston49Author Commented:
This answer got me on the right track. I now have added the required information to my report. Thanks!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.