Powershell - 新用户主文件夹权限

Question

我正在编写一个 PS 脚本来自动化新的网络帐户、他们的主文件夹和交换邮箱。我们有多个域控制器，因此正在寻找一种在一个域控制器上创建网络帐户但在具有自己的域控制器的不同站点上创建主目录的方法。我已经尝试过了，但是在设置权限时出现了问题，因为该帐户尚未复制到另一个 DC。任何人有任何想法来解决这个问题？

新账户功能

Function New-BVStandardUser
{
    Param (
        $FirstName,
        $LastName,
        $CallRef,
        $SiteName,
        $EmployeeID,
        $ExpiryDate,
        $InternetAccess,
        $ExternalEmailAccess
    )

    $ImportGroups = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteGroups.csv" -Delimiter ","
    $ImportServers = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteServers.csv" -Delimiter ","
    $ImportOUs = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteOUs.csv" -Delimiter ","

    # Convert the first and last name so it does not have special characters for the email address/ UPN
    $LastNameEdit = $LastName -replace '[^a-zA-Z]', ''
    $FirstNameEdit = $FirstName -replace '[^a-zA-Z]', ''

    # Fetch a free username from AD based on the provided first and last name from the user
    $Username = Get-ADUsername -FirstName $FirstNameEdit -LastName $LastNameEdit

    # Generate a random password using the imported module
    $Password = Get-Randompassword  

    # Create the AD account based on the inputted fields
    $Params = @{
        DisplayName = "$($LastName), $($FirstName)"
        DirectoryName = "$($LastName), $($FirstName)"
        SamAccountName = "$Username"
        UserPrincipalName = "$FirstNameEdit.$LastNameEdit@Bakkavor.com"
        Comment = "Created $($env:USERNAME) - $(Get-Date -Format dd/MM/yy) - $($CallRef)"
        GivenName = "$FirstNameEdit"
        Surname = "$LastNameEdit"
        Description = "$($SiteName) User"
        Enabled = $true
        ChangePasswordAtLogon = $true
        Path = "$ImportOUs.$($SiteName)"
        HomeDirectory = "\\$ImportServers.$($SiteName)\$Username$"
        HomeDrive = "U"
        AccountPassword = (ConvertTo-SecureString $Password -AsPlainText -Force)
    }

    try
    {
        New-ADUser @Params -ErrorAction Stop
        Write-Verbose -Verbose "Network Account Created"
    }
    catch
    {
        Write-Warning "Error creating network account. Error: $($_.Exception.Message)"
        break
    }

新的 Home Drive 功能

Function New-BVUDrive
{
Param
(
    $Username,
    $Server
)

# Connect to the relevant server in CSV, create new folder, create new SMB Share for the user and add share/ NTFS permissions
    Invoke-Command -ComputerName $Server -ArgumentList $Username -ErrorAction Stop -ScriptBlock 
    {
        param($Username)  

        $FindShare = (Get-SmbShare -Name Users$).Path

        if($FindShare -eq $true)
        {

            try
            {
                New-Item -ItemType Directory -Path "$FindShare\$Username" -ErrorAction Stop
                New-SmbShare -Name "$Username$" -Path "$FindShare\$Username" -FullAccess "AD\Server Admins", "AD\Domain Admins" -ChangeAccess "AD\$Username" -ErrorAction Stop

                $Acl = Get-Acl "$FindShare\$Username"

                foreach($Rule in $Acl.Access) 
                {        
                    $Acl.RemoveAccessRule($Rule)
                }

                $Ar = New-Object  system.security.accesscontrol.filesystemaccessrule("Everyone","FullControl","Allow") 
                $Acl.SetAccessRule($Ar)

                $Acl.SetAccessRuleProtection($false, $true)

                Set-Acl "$FindShare\$Username" $Acl -ErrorAction Stop
            }
            catch
            {
                Write-Warning "U drive failed to create. Error: $($_.Exception.Message)"
            }
        }
        else
        {
            Write-Warning "Users$ share not found on server"
        }
    }
}

Answer 1

您是否尝试过使用 SID？ 在第二个函数 New-BVUDrive 中，将用户名替换为 SID。并使用以下 cmdlet 获取 SID：

(Get-ADUser -Identity $SamAccountName).SID.Value

您现在可以设置 ACL，在数据复制之前，您将在安全选项卡中看到 SID，但如果用户尝试，他将能够访问该文件夹。

$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule ($SIDIdentity, 'FullControl', ('ContainerInherit','ObjectInherit'), 'None','Allow')

希望它会有所帮助。