asked Sep 24, 2023 at 8:58
Get-SmbShare | ForEach-Object {Get-SmbShareAccess -InputObject $_} | Select-Object @( @{Name = 'ReportDate'; Expression = {[DateTime]::Today.ToString('yyyy.MM.dd')}} @{Name = 'ShareName'; Expression = {$_.Name}} 'AccountName' 'AccessControlType' 'AccessRight' ) | Format-Table -AutoSize
<# RESULT:
ReportDate ShareName AccountName AccessControlType AccessRight
---------- --------- ----------- ----------------- -----------
2023.09.25 ADMIN$ BUILTIN\Administrators Allow Full
2023.09.25 ADMIN$ BUILTIN\Backup Operators Allow Full
2023.09.25 ADMIN$ NT AUTHORITY\INTERACTIVE Allow Full
2023.09.25 C$ BUILTIN\Administrators Allow Full
2023.09.25 C$ BUILTIN\Backup Operators Allow Full
2023.09.25 C$ NT AUTHORITY\INTERACTIVE Allow Full
2023.09.25 D$ BUILTIN\Administrators Allow Full
2023.09.25 D$ BUILTIN\Backup Operators Allow Full
#>Or something a little bit more complex:
Get-SmbShare |
ForEach-Object { return [PSCustomObject]@{ Share = $_ ShareAccess = @(Get-SmbShareAccess -InputObject $_) } } | ForEach-Object { $Share = $_.Share $_.ShareAccess | Select-Object @( @{Name = 'ShareName'; Expression = {$Share.Name}} @{Name = 'SharePath'; Expression = {$Share.Path}} 'AccessControlType' 'AccessRight' 'AccountName' ) } | Format-Table -AutoSize
<# RESULT:
ShareName SharePath AccessControlType AccessRight AccountName
--------- --------- ----------------- ----------- -----------
ADMIN$ C:\WINDOWS Allow Full BUILTIN\Administrators
ADMIN$ C:\WINDOWS Allow Full BUILTIN\Backup Operators
ADMIN$ C:\WINDOWS Allow Full NT AUTHORITY\INTERACTIVE
C$ C:\ Allow Full BUILTIN\Administrators
C$ C:\ Allow Full BUILTIN\Backup Operators
C$ C:\ Allow Full NT AUTHORITY\INTERACTIVE
D$ D:\ Allow Full BUILTIN\Administrators
#>answered Sep 24, 2023 at 21:17
2 gold badges20 silver badges27 bronze badges
Find expert answers in this collaborative article
Systems Engineering
Rate this article
We created this article with the help of AI. What do you think of it?
Thanks for your feedback
Your feedback is private. Like or react to bring the conversation to your network.
Report this article
More relevant reading
Help improve contributions
Contribution hidden for you
Effective oversight of sharing links and sharing information are paramount to ensuring data security, compliance, and optimal collaboration experiences.
As organisations migrate to M365 environments, they inherit powerful collaboration tools that facilitate seamless sharing of documents and resources. However, without proper governance, these capabilities can lead to unintended consequences such as data breaches, compliance violations, and loss of intellectual property.
For Copilot for M365 implementations, ensuring there is no oversharing is a critical aspect of safeguarding sensitive information and maintaining regulatory compliance.
However, manually tracking down these links across multiple sites and libraries can be a daunting task. There are few options available, each with its own limitations.
Use sharing auditing in the audit log is restricted to the filter criteria used, which may not retrieve all sharing links.
I have not been able to determine why unique permissions are sometimes created without generating a sharing link. One of the scenerios I noticed is the sharing link is only created when “Copy Link” is clicked on.
So reporting on sharing links might not be enough and look into drilling into unique permissions applied to each file, folder or item. I have provided two flavours of scripts using CSOM, PnP cmdlets and REST API
PowerShell Script overview using the CSOM method GetObjectSharingInformation
Some explanation of the script
Parameters
Connection to SharePoint Online
Retrieval of Sharing Links
Exclusion of Certain Libraries
The script excludes specified libraries (e.g., system libraries) from the sharing links audit using the $ExcludedLists array.
Iteration through Sites and Libraries
Exporting the Report
Finally, the collected sharing link data is exported to a CSV file with a timestamped filename in the designated directory.
Using REST EndPoint
The REST endpoint that can be used to return only sharing links, refer to Externally Sharing – GetSharingInformation REST API
Output of the REST EndPoint call
Using Get-PnPFileSharingLink and Get-PnPFolderSharingLink
The Get-PnPFileSharingLink and Get-PnPFolderSharingLink returns all sharing links created only at file and folder level.
There is no cmdlet to return sharing link at item level yet.
The cmdlets Get-PnPFileSharingLink and Get-PnPFolderSharingLink uses the Graph EndPoint
However using Get-PnPFileSharingLink and Get-PnPFolderSharingLink return only sharing links and not all sharing instances without a link.
References
Microsoft Purview data security and compliance protections for Microsoft Copilot
Use sharing auditing in the audit log
