asked on

Powershell Script to list Permissions

Hi,

We need a script that will cycle through all sub directories from a starting point and give us all users/accounts that have access. Then we can open in Excel and analyze. I have the below code, but it won't look beyond the D:\Data\Triggers directory. Is there a way to cycle through all directories in the D:\ drive?

Invoke-Command -ScriptBlock {get-acl D:\Data\Triggers | 
select -expand access } |
export-csv \\servername\output\permissions.csv

Open in new window

oBdA

Try if this fits your needs.
Get-Help .\Get-AclReport
(or whatever you want to name it) is supported.

<#
.SYNOPSIS
Retrieves NTFS permissions.
.DESCRIPTION
This script retrieves NTFS permissions.
By default, it will 
  - only list an ACL if the permissions contain at least one ACE that is not inherited; use the -IncludeInherited switch to list all ACLs.
  - only list directories; use the -IncludeFiles switch to list files as well.
It will write the results to the pipeline, from where they can be processed further with the usual suspects, like Export-Csv.
.PARAMETER Path
The path to the starting folder for the report.
.PARAMETER IncludeFiles
Include files in the output; by default, only folders will be listed.
.PARAMETER IncludeInherited
Include items in the output that only have inherited permissions; by default, only folders items that contain at least one explicit ACE will be returned.
.INPUTS
System.String
.OUTPUTS
PSCustomObject[]
The objects returned will have a property "Exception" - if this is set, there were problems accessing the path (probably access denied).
.EXAMPLE
.\Get-AclReport | Export-Csv -NoTypeInformation -Path C:\Temp\AclReport.csv
#>
[CmdletBinding()]
Param(
	[Parameter(ValueFromPipeline=$True)]
	[string]$Path = (Get-Location -PSProvider FileSystem).Path,
	[switch]$IncludeFiles,
	[switch]$IncludeInherited
)
#requires -Version 3.0

Begin {
	Function Get-Permission {
	[CmdletBinding()]
	Param(
		[Parameter(ValueFromPipeline=$True)]
		[PSObject]$Item,
		[switch]$IncludeInherited
	)
		Begin {}
		Process {
			Try {
				If ($Item.PsIsContainer) {
					Write-Progress -Activity 'Generating Permissions Report' -Status 'Processing ACLs ...' -CurrentOperation $Item.FullName
				}
				$Acl = $Item.GetAccessControl()
				If ($IncludeInherited -or ($Acl.Access | Where-Object {-not $_.IsInherited})) {
					$Acl.Access | Select-Object -Property `
						@{n='Path'; e={$Item.FullName}},
						@{n='Type'; e={If ($Item.PsIsContainer) {'Directory'} Else {'File'}}},
						@{n='Owner'; e={$Acl.Owner}},
						FileSystemRights,
						AccessControlType,
						IdentityReference,
						IsInherited,
						InheritanceFlags,
						PropagationFlags,
						Exception
				}
			} Catch {
				$_.Exception.InnerException.Message | Select-Object -Property `
					@{n='Path'; e={$Item.FullName}},
					@{n='Type'; e={If ($Item.PsIsContainer) {'Directory'} Else {'File'}}},
					Owner,
					FileSystemRights,
					AccessControlType,
					IdentityReference,
					IsInherited,
					InheritanceFlags,
					PropagationFlags,
					@{n='Exception'; e={$_}}
			}
		}
		End {}
	}
}

Process {
	Get-Item -Path $Path | Get-Permission -IncludeInherited
	Get-ChildItem -Path $Path -Recurse -Directory:$(-not $IncludeFiles) -ErrorAction SilentlyContinue | Get-Permission -IncludeInherited:$IncludeInherited
	Write-Progress -Activity 'Generating Permissions Report' -Status 'Done' -Completed
}

End {}

Open in new window

elwayisgod

ASKER

Hmm. I guess I only have PowerShell 2.0 :(

Bill Prew

If this will be running on a computer that you have some control over (versus a locked down corporate server) then you could update to something newer (3.x, 4.x, 5.x). Lots of notes on this in Microsoft sites, I think Windows 8 was the trickiest one. I seem to recall oBdA may have some links on this too, but I may be confused.

~bp

ASKER CERTIFIED SOLUTION

oBdA

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

elwayisgod

ASKER

oBdA,

The version 2.0 script works. Is there a way to get the output into a .csv file and in columnar format?

SOLUTION

oBdA

membership