question

AlbertEdelstein-0884 avatar image
0 Votes"
AlbertEdelstein-0884 asked RichMatheisen-8856 answered

Adding a column to destinguish between user and group

The Following script generate a breakdown of access and inheritance (true.false)
I want to modify the script to add a column representing whether the access level is a user or a group?


$AllFolders = Get-ChildItem -Directory -Path "R:\" -Recurse -Force

$Results = @()
Foreach ($Folder in $AllFolders) {
$Acl = Get-Acl -Path $Folder.FullName
foreach ($Access in $acl.Access) {
if ($Access.IdentityReference -notlike "BUILTIN\Administrators" -and $Access.IdentityReference -notlike "domain\Domain Admins" -and $Access.IdentityReference -notlike "CREATOR OWNER" -and $access.IdentityReference -notlike "NT AUTHORITY\SYSTEM") {
$Access.IdentityReference
$Properties = [ordered]@{'FolderName'=$Folder.FullName;'AD Group'=$Access.IdentityReference; 'NameIs'=$Access.Name; 'Permissions'=$Access.FileSystemRights;'Inherited'=$Access.IsInherited}
$Results += New-Object -TypeName PSObject -Property $Properties
}
}
}

$Results | Export-Csv -path "C:\Temp\ACL-Report.csv"

windows-server-powershell
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

If you're going to post code, please use the "Code Sample" editor to do so. It's the icon 5th from the left on the format bar (the icon looks like a binary value "101 010").

The normal text editor munges the code. It modifies certain character sequences, alters the presentation of lines of data (e.g. "bolds" them and changes the font size), and makes it difficult to separate the narrative text from the code in a post.

0 Votes 0 ·

1 Answer

RichMatheisen-8856 avatar image
0 Votes"
RichMatheisen-8856 answered

Assuming the IdentityReference property refers only to Active Directory object, use Get-ADObject to retrieve the object and use either objectClass or objectCategory to determine what they are. You may want to use both, though. There are objects in the AD (like a computer account) that have an objectClass of "User" and an objectCategory of "Computer". If you need that level of distinction, it'd probably be better to report them both to avoid surprises.

If, on the other hand, you have LOCAL users in the ACL then if you fail to find the object in the AD you have to use Get-LocalUser and Get-LocalGroup in addition to Get-ADObject to report the type.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.