使用Powershell根据操作员输入对用户文件夹进行权限

I'm new to Powershell, and need some guidance. I need to create a script which will enable a operator to create a remote user folder based on the operator's (string) input. The script would then take that input, create the folder, name it, and then permission it according to the input. So far, I have the "create" part working using this:

我是Powershell的新手，需要一些指导。我需要创建一个脚本，使操作员能够根据操作符（字符串）输入创建远程用户文件夹。然后，脚本将获取该输入，创建文件夹，为其命名，然后根据输入对其进行许可。到目前为止，我使用“创建”部分工作：

'Variables

$directory = Read-Host "Enter Path"

$username = Read-Host "Enter Username"

'Create and name directory

new-item -Path $directory -name $username -ItemType directory

Using the above script, the operator is asked where the folder should be created, and what the folder name should be. in our case, the folder name is the same as the user's name (AD account name). As I said, this is working. The folder gets created, and is inheriting permissions. I now need to find a way to also permission that folder based on the operator's input of the user's NAME (AD account), and give that user Full Control for the parent/child folders, while keeping the inheritance.

使用上面的脚本，将询问操作员应在何处创建文件夹，以及文件夹名称应该是什么。在我们的示例中，文件夹名称与用户名称（AD帐户名称）相同。正如我所说，这是有效的。该文件夹已创建，并且正在继承权限。我现在需要找到一种方法来同时根据操作员输入的用户名称（AD帐户）来限制该文件夹，并在保留继承的同时为该用户提供父/子文件夹的完全控制权。

I am assuming that the script would need to check the NAME against AD, so that it can make sure the NAME is a valid AD account..? As I said, I am new to Powershell. :)

我假设脚本需要检查NAME对AD，以便它可以确保NAME是一个有效的AD帐户..？正如我所说，我是Powershell的新手。 :)

Is this even possible? Thanks!

这有可能吗？谢谢！

3 个解决方案

#1

looks like what you need PowerShell - Editing permissions on a file or folder

看起来像你需要的PowerShell - 编辑文件或文件夹的权限

try reading get-help Get-Acl -full and for Set-Acl commandlets

尝试阅读get-help Get-Acl -full和Set-Acl命令行开关

#2

You don't "need" to check against AD, but it is a good idea.

你不需要“检查”AD，但这是一个好主意。

I personally prefer QAD cmdlets. You get them when you download PowerGUI, although Powergui is not required.

我个人更喜欢QAD cmdlet。下载PowerGUI时可以获得它们，但不需要Powergui。

For setting the user, you can simply do:

要设置用户，您只需执行以下操作：

$User = Read-Host -input "enter user to grant access"
if(get-qaduser $user) {set-Acl $Path $ACLs}
else{write-host "Cannot find user"}

#3

PowerShell ACLs are a bit over complicated. I'd suggest using the icacls command for setting the acl:

PowerShell ACL有点过于复杂。我建议使用icacls命令来设置acl：

PS C:\> icacls /?

As for checking the user against AD you need to query the AD. This way is messy but you don't need to install anything "http://technet.microsoft.com/en-us/library/ff730967.aspx"

至于检查用户对AD，您需要查询AD。这种方式很乱，但你不需要安装任何东西“http://technet.microsoft.com/en-us/library/ff730967.aspx”

This way is easy, but you need the Remote Administration Tools PowerShell AD Module installed.

这种方式很简单，但您需要安装远程管理工具PowerShell AD模块。

(Get-ADuser -Filter {Name -eq $username}).count -ne 0

#1