powershell on modifying permissions

Question

Hi all,

we need to add the group local\admin1 to over 100 folders UNC path like \server1\root1 \server2\root2 and propagated to subfolders and files under these folders. Can anyone help with PowerShell script?

Thank you for your help.

Answer 1

You have to CD to the folder where you saved the script or add the full path to it.

I have updated the code to generate icacls commands to grant access for whatever account you wish. You would need to redirect the output to a file and then execute the commands after you verify that they will make the correct changes. I also added a depth switch.

.\FindUnInheritedPerms.ps1 -target c:\temp -grant "BUILTIN\Administrators:(OI)(CI)(F)" -depth 1

<#

.SYNOPSIS
This is a simple Powershell script to analyze a given folder structure and look to see what files/folder have uninherited ACL's

.DESCRIPTION
Find files/folder where admins/owners have been tweaking security permissions. 

This script accepts these parameters.
-target    The path to the folder to be analyzed.
-all       If true, analyze files in addition to folders.  
-depth     How many subfolders to analyze 
-grant     Generate icacls /grant command for each folder which does not inherit any permissions.

.EXAMPLE
./FindUnInheritedPerms.ps1 -target c:\temp -all $true
./FindUnInheritedPerms.ps1 -target c:\temp 
./FindUnInheritedPerms.ps1 -target c:\temp -depth 2 /grant "BUILTIN\Administrators:(OI)(CI)(F)"


.NOTES

.LINK
http://www.google.com

Author: MotoX80 on Microsoft Q&A Forums 
#>

param (
    [string]$target = '',                            # analyze this folder
    [boolean]$all = $false,                          # include files 
	[string]$grant = '',                              # generate icacls commands
	[string]$depth = '9999999'                       # folder depth to analyze 
 )

if ($target -eq '') {
    "Please specify a target folder to analyze."
    return 
}

if ($grant -eq '') {
	"Base permissions on $target"
	Get-Acl -Path $target | select-object -ExpandProperty access |   format-table -Property IdentityReference, AccessControlType, FileSystemRights, IsInherited 
}
if ($all) {
    $folders = Get-ChildItem -Path $target -depth $depth -recurse
} else {
    $folders = Get-ChildItem -Path $target -Directory -depth $depth -recurse
}


foreach ($folder in $folders) {
    $acls = Get-Acl -Path $folder.FullName
		
    if ($acls.AreAccessRulesProtected -eq $true) {     # we found a folder that does not inherit permissions. 
			if ($grant -eq '') {
				$folder.FullName          # This one 
				$acls | select-object -ExpandProperty access |   format-table -Property IdentityReference, AccessControlType, FileSystemRights, IsInherited
			} else {
				'icacls "{0}" /grant "{1}"' -f $folder.FullName, $grant 
			}
    }
    else {
        # look for additional acls that were added to the ones inherit3ed from parent folder.
        $unique = $acls | select-object -ExpandProperty access | where-Object -property IsInherited -eq $false 
        if (($unique -ne $null) -and ($grant -eq '')) {
            "*{0}      (In addition to inherited perms)" -f $folder.FullName          # This one 
            $unique |  format-table -Property IdentityReference, AccessControlType, FileSystemRights, IsInherited
        }
    }
}

Answer 2

Do you need to actually propagate the permissions? Normally you just set the permissions on the highest level and let it inherit (which it does by default). So you'd set the permission on the root portion of the path (wherever that may be) and then subfolders and files automatically inherit the permission. If you really need to propagate the permissions then that can be done but it'll take a while for Windows to actually update all the child folders and files. The preference is to use inheritance since it is faster and easier to change.

To set a new permission using Powershell you'll need to create the ACE with the group and required permissions, then get the existing ACL from the folder, add the ACE to it and then save it back. The code is a little long but not difficult. Here's a link to a blog article that provides the exact code you need. A summary is provided here for your reference but refer to the article for more information.

   # Create the new ACE  
   $identity = 'domain\group'  
   $rights = 'FullControl'  
   $type = 'Allow'  
     
   # Folders and files inherit this permission, no need to propagate because it will be inherited  
   $inheritance = 'ContainerInherit, ObjectInherit'  
   $propagate = 'None'  
     
   $ace = New-Object System.Security.AccessControl.FileSystemAccessRule($identity, $rights, $inheritance, $propagate, $type)  
     
   # Apply to existing file system object  
   $acl = Get-Acl -Path 'YourPath'  
   $acl.AddAccessRule($ace)  
   Set-Acl -Path 'YourPath' -AclObject $acl  

Answer 3

inheritance is not enabled.

So you will first need to identify folders that do not inherit permissions from their parent folder so that you can apply the desired access to those subfolders.

the above script still valid for my case?

Yes, it will apply permissions to a folder but as I indicated, you need to figure out which folders to run it against.

I have attached a script that I named FindUninheritedPerms.ps1. (Saved as a .txt file.) It will analyze the permissions on a folder structure and report on what subfolders do not inherit their parent folder permissions or have explicit permissions in addition to the inherited ones.

So basically, you will need to merge the two scripts to identify the folders that need to be updated, and then apply the additional permissions.

I strongly recommend that you test your updated script on a test folder structure and verify that the permissions are set correctly before you run it against your "100 folders".

268336-finduninheritedperms.txt

Answer 4

Hello there,

If you are planning to propagate permissions there are a number of ways that PowerShell makes this process easier.
Listing file and folder permissions
Adding file and folder permissions
Removing file and folder permissions
Modify file and folder ownership
Enable or disable folder inheritance

This before script is one such example.

$Folder = 'F:\'
$ACL = Get-Acl $Folder
$ACL_Rule = new-object System.Security.AccessControl.FileSystemAccessRule ('Tree', "ReadAndExecute",”ContainerInherit,ObjectInherit”,”None”,”Allow”)
$ACL.SetAccessRule($ACL_Rule)
Set-Acl -Path $Folder -AclObject $ACL

To modify the inheritance properties of an object, we have to use the SetAccessRuleProtection method

$ACL = Get-Acl -Path "Folder1"
$ACL.SetAccessRuleProtection($true,$false)
$ACL | Set-Acl -Path "Folder1"

---

--If the reply is helpful, please Upvote and Accept it as an answer--