使用 PowerShell 设置 NTFS 文件共享的权限

Question

简而言之，我的脚本应该创建 5 个文件夹、1 个根级文件夹、3 个 2 级文件夹和 1 个 3 级文件夹。

权限在第二级授予，ReadWrite 或 ReadOnly。任何用户都不能在第二层中创建任何内容或删除第二层。

我似乎遇到了Set-Acl 和权限方面的问题。我想知道是否有更好的方法来编写不需要提升权限的脚本。我们的 DA 可以很好地运行脚本，我可以手动创建文件夹和安全组，但它很乏味且容易出错。任何对我做错了什么或如何做得更好的见解将不胜感激。

Import-Module ActiveDirectory
$path = "\\earth\data\group\"
$newFolderName = Read-Host -Prompt "Enter Name of New Folder"
$newFolderFull = $path + $newFolderName
Write-Output "New Folder will be: $newFolderFull"
$confirm = Read-Host "Confirm? Y/N"
if (!(($confirm) -ne "y")) {
    Write-Output "Create AD Groups"
    $groupNamePGroup = "P_$newFolderName"
    $groupNameAdminRW = "EG-$newFolderName-Admin-RW"
    $groupNameAdminRF = "EG-$newFolderName-Admin-RF"
    $groupNameEveryoneRW = "EG-$newFolderName-Everyone-RW"
    $groupNameEveryoneRF = "EG-$newFolderName-Everyone-RF"
    $groupNameScannedDocsRW = "EG-$newFolderName-ScannedDocs-RW"

    New-ADGroup $groupNamePGroup -samAccountName $groupNamePGroup -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameAdminRW -samAccountName $groupNameAdminRW -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameAdminRF -samAccountName $groupNameAdminRF -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameEveryoneRW -samAccountName $groupNameEveryoneRW -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameEveryoneRF -samAccountName $groupNameEveryoneRF -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"
    New-ADGroup $groupNameScannedDocsRW -samAccountName $groupNameScannedDocsRW -GroupScope DomainLocal -path "OU=SecurityGroups,OU=Metro,DC=metrogr,DC=org"

    Write-Output "Add Folder.."
    New-Item $newFolderFull -ItemType Directory
    New-Item $newFolderFull\Admin -ItemType Directory
    New-Item $newFolderFull\Everyone -ItemType Directory
    New-Item $newFolderFull\ScannedDocs -ItemType Directory
    New-Item $newFolderFull\Everyone\ScannedDocs -ItemType Directory

    Write-Output "Remove Inheritance.."
    icacls $newFolderFull /inheritance:d
    icacls $newFolderFull\Admin /inheritance:d
    icacls $newFolderFull\Everyone /inheritance:d
    icacls $newFolderFull\Everyone\ScannedDocs /inheritance:d
    #icacls $newFolderFull\ScannedDocs /inheritance:d

    # Rights
    $readOnly = [Security.AccessControl.FileSystemRights]"ReadAndExecute"
    $readWrite = [Security.AccessControl.FileSystemRights]"Write, DeleteSubdirectoriesAndFiles,ReadAndExecute"

    # Inheritance
    $inheritanceFlag = [Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit"
    # Propagation
    $propagationFlag = [Security.AccessControl.PropagationFlags]::None
    # User
    $PUserRF = New-Object System.Security.Principal.NTAccount($groupNamePGroup)
    $AdminUserRW = New-Object System.Security.Principal.NTAccount($groupnameAdminRW)
    $AdminUserRF = New-Object System.Security.Principal.NTAccount($groupnameAdminRF)
    $EveryoneUserRW = New-Object System.Security.Principal.NTAccount($groupnameEveryoneRW)
    $EveryoneUserRF = New-Object System.Security.Principal.NTAccount($groupnameEveryoneRF)
    $ScannedDocsUserRW = New-Object System.Security.Principal.NTAccount($groupnameScannedDocsRW)
    # Type
    $type = [Security.AccessControl.AccessControlType]::Allow

    #Add Group membership
    Add-ADGroupMember -Identity $groupNamePGroup -Members $groupNameAdminRW,$groupNameAdminRF,$groupNameEveryoneRW,$groupNameEveryoneRF,$groupNameScannedDocsRW
    Add-ADGroupMember -Identity $groupNameEveryoneRW -Members NDPSSCAN
    Add-ADGroupMember -Identity $groupNameScannedDocsRW -Members NDPSSCAN

    # ACL
    $accessControlEntryDefault = New-Object System.Security.AccessControl.FileSystemAccessRule @("Domain Users", $readOnly, $inheritanceFlag, $propagationFlag, $type)
    $accessControlRootEntryRF = New-Object System.Security.AccessControl.FileSystemAccessRule @($PUserRF, $readOnly, $inheritanceFlag, $propagationFlag, $type)
    $accessControlAdminEntryRW = New-Object System.Security.AccessControl.FileSystemAccessRule @($AdminUserRW, $readWrite, $inheritanceFlag, $propagationFlag, $type)
    $accessControlAdminEntryRF = New-Object System.Security.AccessControl.FileSystemAccessRule @($AdminUserRF, $readOnly, $inheritanceFlag, $propagationFlag, $type)
    $accessControlEveryoneEntryRW = New-Object System.Security.AccessControl.FileSystemAccessRule @($EveryoneUserRW, $readWrite, $inheritanceFlag, $propagationFlag, $type)
    $accessControlEveryoneEntryRF = New-Object System.Security.AccessControl.FileSystemAccessRule @($EveryoneUserRF, $readOnly, $inheritanceFlag, $propagationFlag, $type)
    $accessControlScannedDocsEntryRW = New-Object System.Security.AccessControl.FileSystemAccessRule @($ScannedDocsUserRW, $readWrite, $inheritanceFlag, $propagationFlag, $type)

    $objACL = Get-Acl $newFolderFull
    $objACL.RemoveAccessRuleAll($accessControlEntryDefault)
    $objACL.AddAccessRule($accessControlRootEntryRF)
    Set-Acl $newFolderFull $objACL

    $objACL = Get-Acl $newFolderFull\Admin
    $objACL.RemoveAccessRuleAll($accessControlEntryDefault)
    $objACL.AddAccessRule($accessControlAdminEntryRW)
    $objACL.AddAccessRule($accessControlAdminEntryRF)
    Set-Acl $newFolderFull\Admin $objACL

    $objACL = Get-Acl $newFolderFull\Everyone
    $objACL.RemoveAccessRuleAll($accessControlEntryDefault)
    $objACL.AddAccessRule($accessControlEveryoneEntryRW)
    $objACL.AddAccessRule($accessControlEveryoneEntryRF)
    Set-Acl $newFolderFull\Everyone $objACL

    $objACL = Get-Acl $newFolderFull\ScannedDocs
    $objACL.RemoveAccessRuleAll($accessControlEntryDefault)
    $objACL.AddAccessRule($accessControlScannedDocsEntryRW)
    Set-Acl $newFolderFull\ScannedDocs $objACL
}

Answer 1

SetAccessControl($objACL) 为我工作。

Set-ACL 不起作用，因为我的帐户没有提升权限。