Solved

powershell for home folder owner change

Posted on 2016-07-21
4
70 Views
Last Modified: 2016-07-21
Dear Experts,

Could you please help me with this.

I have over 500  user  home folders on a file share

Current owner of some of those home folders are  not the  actual user owners.  I can see that administrator as current owner on some and some other names as owner of some others home folders.  So it is a bit mess to me.

during the account creation, home folder names gets added as %username% in the home folder section in AD.  

For reporting purposes ( to identify who is owner of another home folder)  and to assign ownership of home folders to actual users, Could you please provide me with a PowerShell to run against   \\server\share\users\home ?

for an example;

Mike has a home folder called Mike.Buck   if his home folder's owner is administrator or another user, I would like to be informed about it on a excel and meanwhile, current owner must be changed to Mike.Buck.  I believe Mike must also have full ntfs permissions to his home folder.

thanks
0
Comment
Question by:kuzum
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 13

Assisted Solution

by:Dustin Saunders
Dustin Saunders earned 500 total points
ID: 41723097
Something like this should work:

$outFile = "C:\Users\Administrator\Desktop\owner.csv"

Add-Content -Path $outFile -Value "Folder,Owner"

Import-Module ActiveDirectory

$users = Get-ADUser -Filter * -Properties homeDirectory | select samaccountname,homeDirectory

foreach ($user in $users)
{
    if ($user.homeDirectory)
    {
    Write-Host $user.homeDirectory
    $ACL = Get-Acl $user.homeDirectory
    $owner = $ACL.GetOwner([System.Security.Principal.NTAccount]).ToString()
    $owner2 = $owner.Split('\')
    if ($owner2[1] -ne $user.samaccountname.ToString())
    {
        
        
        try
        {
            $ar = New-Object System.Security.AccessControl.FileSystemAccessRule($user.samaccountname, 'FullControl', 'ContainerInherit,ObjectInherit','None','Allow')
            $acl.SetAccessRule($ar)
            $ACL.SetOwner([System.Security.Principal.NTAccount]$user.samaccountname)
            Set-Acl -Path $user.homeDirectory -AclObject $ACL -whatif
            $outContent = $user.homeDirectory + ",Owner was " + $owner2[1] + ".  Set to " + $user.samaccountname + "."
            Add-Content -Path $outFile -Value $outContent
            
        }
        catch
        {
           $outContent = $user.homeDirectory + ",Owner was " + $owner2[1] + ", but I couldn't set it to " + $user.samaccountname + "."
            Add-Content -Path $outFile -Value $outContent
        }
    }

    }
}

Open in new window


It's in whatif mode, so you can remove "-whatif" from this time if the results look correct.
Set-Acl -Path $user.homeDirectory -AclObject $ACL -whatif

Open in new window

0
 

Author Comment

by:kuzum
ID: 41723350
Dustin,

this is just excellent!  output was as I expected.

I'm assuming it is only exporting home folders that currently owned by others and not exporting Mike.Buck as Mike already owner of his home folder?

One small favour please, if I wanted to run this against a specific OU in AD ( I want to do 100 users a day),  could you modify it for me?
0
 
LVL 13

Accepted Solution

by:
Dustin Saunders earned 500 total points
ID: 41723454
Yeah, you can do that with a SearchBase (just change the one in the sample here to the OU you want to do).

$outFile = "C:\Users\Administrator\Desktop\owner.csv"
$searchBase = "OU=CompanyA,OU=Clients,OU=zUsers,DC=WizDev,DC=Local"

Add-Content -Path $outFile -Value "Folder,Owner"

Import-Module ActiveDirectory

$users = Get-ADUser -Filter * -SearchBase $searchBase -Properties homeDirectory | select samaccountname,homeDirectory

foreach ($user in $users)
{
    if ($user.homeDirectory)
    {
    Write-Host $user.homeDirectory
    $ACL = Get-Acl $user.homeDirectory
    $owner = $ACL.GetOwner([System.Security.Principal.NTAccount]).ToString()
    $owner2 = $owner.Split('\')
    if ($owner2[1] -ne $user.samaccountname.ToString())
    {
        
        
        try
        {
            $ar = New-Object System.Security.AccessControl.FileSystemAccessRule($user.samaccountname, 'FullControl', 'ContainerInherit,ObjectInherit','None','Allow')
            $acl.SetAccessRule($ar)
            $ACL.SetOwner([System.Security.Principal.NTAccount]$user.samaccountname)
            Set-Acl -Path $user.homeDirectory -AclObject $ACL -whatif
            $outContent = $user.homeDirectory + ",Owner was " + $owner2[1] + ".  Set to " + $user.samaccountname + "."
            Add-Content -Path $outFile -Value $outContent
            
        }
        catch
        {
           $outContent = $user.homeDirectory + ",Owner was " + $owner2[1] + ", but I couldn't set it to " + $user.samaccountname + "."
            Add-Content -Path $outFile -Value $outContent
        }
    }

    }
}

Open in new window

0
 

Author Closing Comment

by:kuzum
ID: 41723567
excellent result.
0

Featured Post

Are You Headed to Black Hat USA 2017?

Getting ready for Black Hat next week? Kick things off with the WatchGuard Badge Challenge and test your puzzle and cipher skills. Do you have what it takes to earn our limited edition Firebox Badge? Get started today - https://crimsonthorn.net

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question