Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 156
  • Last Modified:

PowerShell: Grant NTFS Permissions to Folders

I have a folder structure in a domain environment that contains child folders bearing the names of the Active Directory user accounts that i need to have full control to their respective folder.  How would i script this permission change in PowerShell?
0
marrj
Asked:
marrj
  • 2
  • 2
1 Solution
 
Schnell SolutionsSystems Infrastructure EngineerCommented:
Let's assume that your folder is located at 'C:\Public'

In order to use power shell ACL modification commands and avoid specifying many lines of code, it is better that you use a variable containing the reference permissions that you need. For example, let's say that you have the file 'C:\Public\ACLTemplate.txt' including the NTFS permissions that you have. You can take these permissions as a reference and put then in a variable like this:
$DesiredPermissions = Get-ACL C:\Public\ACLTemplate.txt

Finally, in order to apply all of these NTFS settings to all existing folders in C:\Public. (i.e. C:\Public\Folder1, C:\Public\Folder2, C:\Public\Folder3, ... , C:\Public\FolderN
You can execute:

Set-ACL   -Path C:\Public\*   -AclObject   $DesiredPermissions


Or if you want, you can make the whole process with just one line, and no need of a variable just using:
Get-ACL C:\Public\ACLTemplate.txt | Set-ACL   -Path C:\Public\*
0
 
Schnell SolutionsSystems Infrastructure EngineerCommented:
By the way, I believe that you know that you can also use CMD commands, even from Power Shell in order to achieve the same goal. Using ICACLS for example, allows you to specify the desired permissions easily.

For example, if you want to assign Full access permission for John.Smith in all the sub-folders inside C:\Public, you just need to run:

ICACLS   C:\Public\*   /Grant   john.smith:F
0
 
Dustin SaundersDirector of OperationsCommented:
If the folders match the usernames, you can use the following.
$path = "C:\Share"

$folders = Get-ChildItem -Path $path

foreach ($folder in $folders)
{
    try {
    $user = $folder.BaseName
    $acl = Get-Acl $folder.FullName
    $ar = New-Object System.Security.AccessControl.FileSystemAccessRule($user,"FullControl","Allow")
    $acl.SetAccessRule($ar)
    Set-Acl $($folder.FullName) $acl
    } catch {
    Write-Host $folder.FullName did not have a matching user.
    }
}

Open in new window

0
 
Dustin SaundersDirector of OperationsCommented:
I should mention, you can test run this with this code (added -whatif to line 12):
$path = "C:\Share"

$folders = Get-ChildItem -Path $path

foreach ($folder in $folders)
{
    try {
    $user = $folder.BaseName
    $acl = Get-Acl $folder.FullName
    $ar = New-Object System.Security.AccessControl.FileSystemAccessRule($user,"FullControl","Allow")
    $acl.SetAccessRule($ar)
    Set-Acl $($folder.FullName) $acl -whatif
    } catch {
    Write-Host $folder.FullName did not have a matching user.
    }
}

Open in new window

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now