• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 45
  • Last Modified:

powershell script to get list of user have acces to folder and sub folder

Hi,

i need to get list off users have an acces to files under folder and subfolders
i have many different access and each of my folders have different security group
i need to get all the users of all groups with the folder name

presently i use this script but i cant get the member of each groups in same time

$OutFile = "C:\temp\Permissions.csv"
$Header = "Folder Path,IdentityReference,AccessControlType,IsInherited,InheritanceFlags,PropagationFlags"
Add-Content -Value $Header -Path $OutFile

$RootPath = "\\my root folder\"

$Folders = dir $RootPath -recurse | where {$_.psiscontainer -eq $true}

foreach ($Folder in $Folders){
      $ACLs = get-acl $Folder.fullname | ForEach-Object { $_.Access  }
      Foreach ($ACL in $ACLs){
      $OutInfo = $Folder.Fullname + "," + $ACL.IdentityReference  + "," + $ACL.AccessControlType + "," + $ACL.IsInherited + "," + $ACL.InheritanceFlags + "," + $ACL.PropagationFlags
      Add-Content -Value $OutInfo -Path $OutFile
      }
}
0
Stéphane Boisvert
Asked:
Stéphane Boisvert
  • 2
1 Solution
 
amodeoCommented:
If it doesn't absolutely have to be a powershell script, netwrix makes a completely free tool that does this.  I know it doesn't directly answer your question but I have found it very helpful for this info.

https://www.netwrix.com/netwrix_effective_permissions_reporting_tool.html

-Joe
0
 
Dustin SaundersDirector of OperationsCommented:
You could just add a recursive group check into each ACL check.

$OutFile = "C:\test\Permissions.csv"
$Header = "Folder Path,IdentityReference,AccessControlType,IsInherited,InheritanceFlags,PropagationFlags"
Add-Content -Value $Header -Path $OutFile 

$RootPath = "C:\test\"

$Folders = dir $RootPath -recurse | where {$_.psiscontainer -eq $true}

foreach ($Folder in $Folders){
      $ACLs = get-acl $Folder.fullname | ForEach-Object { $_.Access  }
      Foreach ($ACL in $ACLs)
      {
          $OutInfo = $Folder.Fullname + "," + $ACL.IdentityReference  + "," + $ACL.AccessControlType + "," + $ACL.IsInherited + "," + $ACL.InheritanceFlags + "," + $ACL.PropagationFlags
          Add-Content -Value $OutInfo -Path $OutFile

            $groupName = $acl.IdentityReference.ToString()
            $groupNameA = $groupName.Split('\')
            $groupName = $groupNameA[1]
            try 
            {
                $members = Get-ADGroupMember $groupName -Recursive
                foreach ($member in $members)
                {
                    $OutInfo = $Folder.Fullname + "," + $groupNameA[0] + "\" + $member.samaccountname  + "," + $ACL.AccessControlType + "," + $ACL.IsInherited + "," + $ACL.InheritanceFlags + "," + $ACL.PropagationFlags
                    Add-Content -Value $OutInfo -Path $OutFile
                }
            }
            catch {}

          
      }
}

Open in new window

2
 
Stéphane BoisvertTechnical analystAuthor Commented:
Thank you Dustin for your comment
it work perfectly
0
 
Dustin SaundersDirector of OperationsCommented:
Asker confirmed solution works for them.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now