递归设置 ReadOnly ACL

Question

我想使用以下脚本在文件夹及其子文件夹上递归设置只读访问类型：

有什么帮助吗？

$list = import-csv "C:\Users\s849668adm\Desktop\Grouptest.txt"

foreach($sg in $list) {

$grp = $sg.Group

$colRights = [System.Security.AccessControl.FileSystemRights]"ReadANDExecute"

$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]:: ContainerInherit
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]:: None

$objType =[System.Security.AccessControl.AccessControlType]::Allow

$objUser = New-Object System.Security.Principal.NTAccount($grp)

$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
    ($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType)

$objACL = Get-ACL "C:\Users\s849668adm\Desktop\Test"
$objACL.SetAccessRule($objACE)
Set-ACL "C:\Users\s849668adm\Desktop\Test" $objACL 
}

脚本正在运行，但如果在子文件夹上设置了 ACL，则该脚本不会更改访问类型，而是在父文件夹“C:\Users\s849668adm\Desktop\Test”中复制一个新的只读访问类型。

Answer 1

以下脚本有效，但排除了父文件夹“C:\Users\s849668adm\Desktop\Test”

    $list = import-csv "C:\Users\s849668adm\Desktop\Grouptest.txt"

    foreach($sg in $list) {

    $grp = $sg.Group

    $colRights = [System.Security.AccessControl.FileSystemRights]"ReadANDExecute"

    $InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]:: 
     ContainerInherit
    $PropagationFlag = [System.Security.AccessControl.PropagationFlags]:: None

    $objType =[System.Security.AccessControl.AccessControlType]::Allow

    $objUser = New-Object System.Security.Principal.NTAccount($grp)

    $objACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
   ($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType)

    $folder = Get-ChildItem  -path "C:\Users\s849668adm\Desktop\Test" -Recurse
      ForEach ($fl in $folder) 
          {

            echo $fl
            $objACL = Get-ACL $fl.PSPath
            $objACL.SetAccessRule($objACE)
            Set-ACL $fl.PSPath  $objACL 
          }

                               }

Answer 2

我认为您缺少ObjectInherit继承标志。
此外，在 PowerShell 中，还有一种更简洁的方法来创建访问规则：

$folder = "C:\Users\s849668adm\Desktop\Test"
Import-Csv "C:\Users\s849668adm\Desktop\Grouptest.txt" | ForEach-Object {
    $grp = New-Object System.Security.Principal.NTAccount($_.Group)
    # create the new access rule
    $ace = New-Object System.Security.AccessControl.FileSystemAccessRule($grp, "ReadAndExecute", "ContainerInherit,ObjectInherit", "None", "Allow")
    $acl = Get-ACL $folder
    $acl.SetAccessRule($ace)
    $acl | Set-ACL $folder
}

希望有帮助