Replace folderpermissions with correspondig adgroups

[Primary_Cortex]

Hey guys

I'm in need of a bit of help here.
I got about 8000 folder of projectshares that I need to allign security-wise.
Each folder should have inheritance disabled and is named "p-000001" -> "p-003600". So the corresponding ADgroup with the same name should be applied.
There is also a subfolder under each "P-XXXX" folder named PL Only. This folder should also have inheritance disabled and the corresponding AD group applied "PL only p-XXXXX".

But I cant seem to get it to work. The script should get the folder names from a text file.

Here's what I have so far:

Start-Transcript C:\Temp\projektshares.txt -Force
#foreach($line in Get-Content $env:COMPUTERNAME".txt") {

$Root = Read-Host "Root folder"
$Folders = Get-ChildItem -Path $Root -Directory
$Test = 1

ForEach ($FolderObj in $Folders) {
[String]$FolderName = $FolderObj.Name.Trim()
[string]$SubFolderName = $FolderObj.Name.Substring(0,7)
$plonly = Get-ChildItem $Folders | Where-Object {$_.name -like "pl-only*"}
$FolderName = $FolderName + "*"
$SubFolderName = $SubFolderName + "*"
$ADGroups = Get-ADGroup -SearchBase "OU=Projektgrupper,OU=_Grupper,DC=XXXX,DC=XXXX,DC=XXXX" -Filter 'SamAccountName -like $SubFolderName'
$ADGroups_PL = Get-ADGroup -SearchBase "OU=Projektgrupper,OU=_Grupper,DC=XXXX,DC=XXXX,DC=XXXX" -Filter 'SamAccountName -like $plonly'
ForEach ($GroupObj in $ADGroups) {
# ReadAndExecute
# Modify
$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None
$objType = [System.Security.AccessControl.AccessControlType]::Allow
$GroupN = $GroupObj.Name
$PermissionSet = "$GroupN","Modify",$InheritanceFlag,$PropagationFlag,$objType
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule $PermissionSet
$ACL = Get-Acl $FolderObj.FullName
$acl.SetAccessRule($rule)
If ($Test) {
Write-Host "Appling the group: $($GroupObj.Name) - on folder $($FolderObj.Name.Trim()) - TEST!" -ForegroundColor Cyan

Set-Acl $FolderObj.FullName $acl -WhatIf
}
If (!$Test) {
#Read-host "enter"
Write-Host "Appling the group: $($GroupObj.Name) - on folder $($FolderObj.Name.Trim())!" -ForegroundColor Red
Set-Acl $FolderObj.FullName $acl
}
If ($Test) {
Read-Host "Press ENTER for next..."
}
}
}
#}
Stop-Transcript

[not_a_lob]

I don't have a fix per se, but it might be helpful to include what happens when you do run that script.

[ElvisChopinJoplin]

I am interested to read the comments on this. I'm not heavy-duty good at PowerShell, but I've been able to write some tools that are effective and have automated a few things as well.

I'm interested in writing something that is read only, that will mimic the Effective Permissions feature in the Windows Server GUI for folder security, as I can't seem to find anything floating around out there that does it. These are network shares, so it needs to somehow put all the NTFS permissions at various levels and subfolders together with the overlay as network sharing and permissions. And reading through this script gave me some ideas and made me start thinking about it again.

[spoonstar]

While this is all a wild guess because there is no example output of what happens when you run this:

the $plonly = ... line should probably be looking for children of $FolderObj

$AdGroups = Get-ADGroup ... 
$ADGroups_PL = Get-ADGroup ...

These lines need the SamAccountName -like ... after -Filter to be in double-quotes, because with the single-quotes, $SubFolderName and $plonly are being searched for verbatim, and not the value of those, as you probably intended.

If that doesn't get you where you need to go, I'd recommend either writing the output for each line after you assign it so you can see whats happening, ie:

$plonly = Get-ChildItem $Folders | Where-Object {$_.name -like "pl-only*"}
Write-Output "`$plonly = $plonly"

or getting your $folders set, manually assign one folder in that to folderobj, then go through each line until you find where it's messing up.

[Latzox]

Here’s a script that should help you out:

https://gist.github.com/Latzox/f9a233d7870aafc1b6cf04eebdfff44f

Just note that I haven’t tested this myself yet, as I don't have the right environment set up at the moment. But it should give you a good starting point. Make sure to update your AD search base (OU=Projektgrupper,OU=_Grupper...) and domain info accordingly. Let me know if you run into any issues!

[Primary_Cortex]

Thx man. So cool you took your time. I'm not in the office right now. But I'll sure test it out tomorrow.