get-NTFSExplicitPermissions
As one of favourite time saving functions of late, I thought I'd continue my recent trend of blogging again by giving a bit of insight to it's background.
One of the parts to my day job is looking after file servers. I don't do day to day admin work on them, more look at managing space and migrating data to new servers / volumes if required.
Now the problem with doing the data migrations and not being involved in the day to day admin work (ie assigning permissions creating shares etc) is that I have no control over how and where the permissions are assigned. I learnt how to assign permissions to file systems years ago in Novell environments, which was soon followed with the MCSE taught A-G-D-L-P model. (AGDLP? now that sound like a reasonable blog post for an AD Admin blog site!)
Anyway, I have since found that these early teaching on permission models are not implemented as thoroughly as I would like, where ever I seem to work - hence, get-NTFSExplicitPermissions.
This function allows you to return any permissions that have been assigned below the root of the folder structure, giving you exactly who would be affected if you move the data to somewhere else. It defaults to 3 levels deep so it doesn't take hours to run on deep tree structures.
To run it all you need is the path parameter (which is also works as positional parameter 0) and you are away....
get-NTFSExplicitPermissions -path e:\data
or
get-NTFSExplicitPermissions e:\data
and you get something like this :
PS C:\Users\Administrator> get-NTFSExplicitPermissions e:\data
path IdentityReference FileSystemRights AccessControlType
---- ----------------- ---------------- -----------------
e:\data BUILTIN\Administrators FullControl Allow
E:\data\2 CREATOR OWNER 268435456 Allow
E:\data\2 NT AUTHORITY\SYSTEM FullControl Allow
E:\data\2 BUILTIN\Administrators FullControl Allow
E:\data\2 BUILTIN\Users ReadAndExecute, Synchronize Allow
E:\data\2 BUILTIN\Users CreateFiles, AppendData Allow
E:\data\users CREATOR OWNER FullControl Allow
E:\data\users NT AUTHORITY\SYSTEM FullControl Allow
E:\data\users BUILTIN\Administrators FullControl Allow
E:\data\users BUILTIN\Users ReadAndExecute, Synchronize Allow
E:\data\users BUILTIN\Users ...s, AppendData, Synchronize Allow
E:\data\users CORE\Adam Stone FullControl Allow
note the last line is where I have assigned myself the full control permission to the users folder. The rest of the permissions suggests that inheritance has been switched off on both e:\data\2 and e:\data\users as the default permissions are showing up as not inherited.
To increase the depth of the search, just use the recurse parameter...this will dig 10 folders deep from the root :
get-NTFSExplicitPermissions -path e:\data -recurse 10
Of course, you can filter the results in the same way as you would with the where clause... to remove NT AUTHORITY and BUILTIN results you can do this :
get-NTFSExplicitPermissions -path e:\data | Where {$_.IdentityReference -notlike "NT AUTHORITY*" -and $_.IdentityReference -notlike "BUILTIN*"}
this command run on the same folder as above returns :
path IdentityReference FileSystemRights AccessControlType
---- ----------------- ---------------- -----------------
E:\data\2 CREATOR OWNER 268435456 Allow
E:\data\users CREATOR OWNER FullControl Allow
E:\data\users CORE\Adam Stone FullControl Allow
This function has already saved me more time than it took to write!
Oh, and thanks goes to Ivan for his input!
cheers
Adam
Comments
Post a Comment