Skip to main content

quick look at get-NTFSExplicitPermissions

As one of favourite time saving functions of late, I thought I'd continue my recent trend of blogging again by giving a bit of insight to it's background.

One of the parts to my day job is looking after file servers.  I don't do day to day admin work on them, more look at managing space and migrating data to new servers / volumes if required.

Now the problem with doing the data migrations and not being involved in the day to day admin work (ie assigning permissions creating shares etc) is that I have no control over how and where the permissions are assigned.  I learnt how to assign permissions to file systems years ago in Novell environments, which was soon followed with the MCSE taught A-G-D-L-P model. (AGDLP? now that sound like a reasonable blog post for an AD Admin blog site!)

Anyway, I have since found that these early teaching on permission models are not implemented as thoroughly as I would like, where ever I seem to work - hence, get-NTFSExplicitPermissions.

This function allows you to return any permissions that have been assigned below the root of the folder structure, giving you exactly who would be affected if you move the data to somewhere else.  It defaults to 3 levels deep so it doesn't take hours to run on deep tree structures.  

To run it all you need is the path parameter (which is also works as positional parameter 0) and you are away....

get-NTFSExplicitPermissions -path e:\data


get-NTFSExplicitPermissions e:\data

and you get something like this : 

PS C:\Users\Administrator> get-NTFSExplicitPermissions e:\data

path                          IdentityReference                          FileSystemRights             AccessControlType
----                          -----------------                          ----------------             -----------------
e:\data                       BUILTIN\Administrators                          FullControl                         Allow
E:\data\2                     CREATOR OWNER                                     268435456                         Allow
E:\data\2                     NT AUTHORITY\SYSTEM                             FullControl                         Allow
E:\data\2                     BUILTIN\Administrators                          FullControl                         Allow
E:\data\2                     BUILTIN\Users                   ReadAndExecute, Synchronize                         Allow
E:\data\2                     BUILTIN\Users                       CreateFiles, AppendData                         Allow
E:\data\users                 CREATOR OWNER                                   FullControl                         Allow
E:\data\users                 NT AUTHORITY\SYSTEM                             FullControl                         Allow
E:\data\users                 BUILTIN\Administrators                          FullControl                         Allow
E:\data\users                 BUILTIN\Users                   ReadAndExecute, Synchronize                         Allow
E:\data\users                 BUILTIN\Users                 ...s, AppendData, Synchronize                         Allow
E:\data\users                 CORE\Adam Stone                                 FullControl                         Allow

note the last line is where I have assigned myself the full control permission to the users folder.  The rest of the permissions suggests that inheritance has been switched off on both e:\data\2 and e:\data\users as the default permissions are showing up as not inherited.

To increase the depth of the search, just use the recurse parameter...this will dig 10 folders deep from the root :

get-NTFSExplicitPermissions -path e:\data -recurse 10

Of course, you can filter the results in the same way as you would with the where clause... to remove NT AUTHORITY and BUILTIN results you can do this : 

get-NTFSExplicitPermissions -path e:\data | Where {$_.IdentityReference -notlike "NT AUTHORITY*" -and $_.IdentityReference -notlike "BUILTIN*"}

this command run on the same folder as above returns : 

path                          IdentityReference                          FileSystemRights             AccessControlType
----                          -----------------                          ----------------             -----------------
E:\data\2                     CREATOR OWNER                                     268435456                         Allow
E:\data\users                 CREATOR OWNER                                   FullControl                         Allow
E:\data\users                 CORE\Adam Stone                                 FullControl                         Allow

This function has already saved me more time than it took to write!  

The latest release can be downloaded here, and for more info on the module see here.

Oh, and thanks goes to Ivan for his input!




Popular posts from this blog

PowerShell 3 behavioural change

It's taken me way too long to get into PowerShell 3, I guess opportunity hasn't shown it's self until now and so, here, my V3 journey begins.

I was asked to debug a script that would run fine in PS v2 and not in v3.  The issue was a that a variable length was being checked and was failing in v3.  This is why...

In v2 if a variable is undefined, this test returns false

PS C:\windows\system32> $var.length -eq 0

In v3 the same test returns true....

PS C:\windows\system32> $var.length -eq 0

Not a biggie, but as in this case, a script has broken so something to consider!



Enable Powershell Remoting (WinRM) via Group Policy

I have been doing some testing on enabling WinRM via group policy, being that WinRM is the service that Powershell v2 sets up it remoting capabilities. Here are the GPO settings that you need to configure WinRM ....

set the winrm service to auto start

Computer Configuration \ Policies \ Windows Settings \ Security Settings \ System Services

Windows Remote Management (WS-Management)  set Startup Mode to Automatic

start the service

incorporated in to the above - you may need a restart.

create a winrm listener

Computer Configuration / Policies / Administrative Templates / Windows Components / Windows Remote Management (WinRM) / WinRM Service / Allow automatic configuration of listeners

IPv4 filter: *

* is listen on all addresses, or if you only want a particular IP address to respond use an iprange eg - don't forget that this IP range has to be valid for all hosts that fall in the scope of the GPO you are creating.  You can use -, - …

compare-object in Powershell - comparing mulitple values

I'm starting to use compare-object more and more, and one thing I noticed, is that you can compare 2 objects based on multiple attributes. here is how it is constructed...
Compare-Object -ReferenceObject $object1 -DifferenceObject $object2 -Property a,b,c,d,eIf a,b,c and d are the same, but e is different, compare object will return a difference. In the following example, I use "-eq $null" as a check because by default compare-object returns $null if the objects are the same.
#create an array of objects to check against

$collection = @()
foreach ($entry in ("aaaaa","bbbbb","ccccc","ddddd")){
   $store = "" | select "a","b","c","d","e"
   $store.a = $entry*1
   $store.b = $entry*2
   $store.c = $entry*3
   $store.d = $entry*4
   $store.e = $entry*5
   $collection += $store

#create an object similar to those in the array
$object = "" | select "a","b…