Resetting Home Drive Permissions PS Script
have client messed home drive permissions. root folder had domain users - read / write ntfs permissions, when ever users home folder created, inherited permission. so, on domain has access everyone's home drives. have run in issue in past, , found script while (see below) works wonders. goes through , grants full access permissions each user, on own folder. problem is, not remove domain users group, has full access. there can add take care of this?
other way have done before set ntfs permissions on root folder containing home drive folders domain admins have full access, no other permissions set. sharing everyone, should be. then, check box replace child items, each home drive folder has same permissions root - domain admins only, run script , adds each user proper permissions folder.
problem method takes forever, there close tb of data in folder , take incredibly long time. also, users in company access data throughout week, including weekends, moment of time loose access.
ideas?
############################################################################ # script: repair-homefolderpermissions.ps1 # author: chris brown http://www.flamingkeys.com # date: 20/10/2010 # keywords: # comments: # pre-requisites: full control on destination folder. # # +------------+-----+---------------------------------------------------------+ # | date | usr | description | # +------------+-----+---------------------------------------------------------+ # | 20/10/2010 | cjb | initial script | # | 28/09/2011 | cjb | fixed flags issue | # +------------+-----+---------------------------------------------------------+ # # disclaimer # ========== # code made available is, without warranty of kind. entire # risk of use or results use of code remains user. ############################################################################# # ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? # variables # # root of home drives? $homedrivesdir="f:\data\homedrives" # report only? ($false = fix problems) $reportmode = $false # print valid directories? $verbose = $false # domain users in? $domainname = "mydomiain.local" # # ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? # save current working directory before change (purely convenience) pushd . # change location of home drives set-location $homedrivesdir # warn user if fixing or reporting on problems write-host "" if ($reportmode) { write-host "report mode on. not fixing problems" } else { write-host "report mode off. fix problems" } write-host "" # initialise few counter variables. useful multiple executions same session $goodpermissions = $unfixablepermissions = $fixedpermissions = $badpermissions = 0 $failedfolders = @() # every folder in $homedrivesdir folder foreach($homefolder in (get-childitem $homedrivesdir | {$_.psiscontainer -eq $true})) { # dump current acl in variable $acl = get-acl $homefolder # create permission mask in form of domain\username username=foldername # (adjust necessary if home folders not usernames) $comparestring = "*" + $domainname + "\" + $homefolder.name + " allow fullcontrol*" # if permission mask in acl if ($acl.accesstostring -like $comparestring) { # everything's good, increment counter , move on. if ($verbose) {write-host "permissions valid for" $homefolder.name -backgroundcolor green -foregroundcolor white} $goodpermissions += 1 } else { # permissions invalid, either fix or report # increment number of permissions needing repair $badpermissions += 1 # if we're in report mode if ($reportmode -eq $true) { # reportmode on, don't write-host "permissions not valid for" $homefolder.name -backgroundcolor red -foregroundcolor white } else { # reportmode off, fix permissions write-host "setting permissions for" $homefolder.name -foregroundcolor white -backgroundcolor red # add user in format domain\username $username = $domainname + "\" + $homefolder.name # grant user full control $accesslevel = "fullcontrol" # should permissions inherited above? $inheritanceflags = "containerinherit, objectinherit" # should permissions propagate below? $propagationflags = "none" # allow/deny entry? $accesscontroltype = "allow" try { # create access rule $accessrule = new-object system.security.accesscontrol.filesystemaccessrule($username,$accesslevel,$inheritanceflags,$propagationflags,$accesscontroltype) # attempt apply access rule acl $acl.setaccessrule($accessrule) set-acl $homefolder $acl # if hasn't errored out now, increment counter $fixedpermissions += 1 } catch { # failed! # increment fail count $unfixablepermissions += 1 # , add folder list of failed folders $failedfolders += $homefolder } } #/if } #/if } #/foreach # print out summary write-host "" write-host $goodpermissions "valid permissions" write-host $badpermissions "permissions needing repair" if ($reportmode -eq $false) {write-host $fixedpermissions "permissions fixed"} if ($unfixablepermissions -gt 0) { write-host $unfixablepermissions "acls not repaired." foreach ($folder in $failedfolders) {write-host " -" $folder} } # cleanup popd
hi commdudeaf,
to remove ntfs permission of domain users group, script below reference:
$found = $false $acl = get-acl -path $path foreach($acc in $acl.access ) { if ($acc.isinherited -eq $ture) #filter ntfs permission inherited { $value = $acc.identityreference.value $right = $acc.filesystemrights.filesystemrights if($value -eq "the domain\domain users") #filter domain users group { write-host "remove $value $path " -foregroundcolor red $null = $acl.removeaccessrule($acc) $found = $ture } else { write-host "skipped $value $path " -foregroundcolor green } } } if ($found) { # uncomment remove aces # set-acl -path $path -aclobject $acl -erroraction stop } } if there else regarding matter, please feel free post back.
best regards,
anna wang
Windows Server > Windows PowerShell
Comments
Post a Comment