powershell - 使用Powershell分配文件夹权限时遇到问题

Question

我希望此Powershell脚本创建一个新目录，并为组添加/分配权限。

该组正在添加，但是权限未显示在“安全性”选项卡上的“属性”下。如果转到高级安全性，则权限确实会显示在此处。

此外，父文件夹权限也不会按需要从新的子文件夹中删除。

$groups = "DOMAIN\GROUP"
$Perm = "MODIFY"
$Permission = [System.Security.AccessControl.FileSystemRights] $Perm
$AllInherit = [System.Security.AccessControl.InheritanceFlags] "None"
$AllPropagation = [System.Security.AccessControl.PropagationFlags] "InheritOnly"
$path = "c:\temp\test"
new-item -path $path -itemtype directory -force
$group = $groups
$GetACL = Get-Acl $Path
$Access = New-Object System.Security.Principal.NTAccount ($group)
$AccessRule = New-Object system.security.AccessControl.FileSystemAccessRule($Access, $perm, $AllInherit, $Allpropagation, "Allow")
$GetACL.SetAccessRule($AccessRule)
SET-ACL -PATH $path $getacl

Answer 1

这是我出于类似目的编写的函数:

function Add-AclEntry {
    # Adds a new entry to the specified file system object ACL. For
    # folders the new permissions are applied recursively.
    # Returns: null.
    param(
        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [String]$sPath,

        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        # Access group (full notation).
        [String]$sGroup,

        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        # List of access rights, comma separated.
        [String]$sRights,

        [Parameter(Mandatory=$false)]
        [ValidateSet("Allow", "Deny")]
        [String]$sType = "Allow"
    )

    $cRights = [System.Security.AccessControl.FileSystemRights]$sRights
    $oType = [System.Security.AccessControl.AccessControlType]::$sType
    $oGroup = New-Object -TypeName System.Security.Principal.NTAccount($sGroup)

    # Inheritance flags: full inheritance.
    if ((Get-Item $sPath).PSIsContainer) {
        $oInheritanceFlags = (`
             [System.Security.AccessControl.InheritanceFlags]::ObjectInherit `
        -bor [System.Security.AccessControl.InheritanceFlags]::ContainerInherit)
    } else {
        $oInheritanceFlags = `
            [System.Security.AccessControl.InheritanceFlags]::None
    }
    $oPropagationFlags = [System.Security.AccessControl.PropagationFlags]::None

    # Creating access control entry and adding it to the ACL.
    $oAce = New-Object `
        -TypeName System.Security.AccessControl.FileSystemAccessRule `
        ($oGroup, $cRights, $oInheritanceFlags, $oPropagationFlags, $oType)
    $oAcl = Get-Acl -Path $sPath
    $oAcl.AddAccessRule($oAce)
    Set-Acl -Path $sPath -AclObject $oAcl

    return $null
}

用法示例(为 Modify组添加 Authenticated Users权限):

$sGroup = "NT AUTHORITY\Authenticated Users"
$sRights = "Delete, Read, Traverse, Write"
Add-AclEntry -sPath $sFolder -sGroup $sGroup -sRights $sRights

希望能有所帮助。