[August 25th, 2008] Check the home page regarding PowerShell related news from a brand new sponsor: Idera!
This question is related to my previous thread here, but since it's a different topic figure I would seperate it. Right now my script will grab the first letter of the user's first name, and if it is A-M it creates a new userhome directory on server1, if not, it creates it on server2. This part works great, but I'm not quite sure of how to add the user with 'modify' permissions on the directory? If possible I would also like the code for 'full control' permissions as I will need that portion for a completely different directory later. Here's a snippet of what I got: $strFname = "Jack" $SmAccount = "JReacher" $strUHAM = "\\server1\privlun01$\home" $strUHNZ = "\\server2\privlun02$\home" $strFnameInit = $strFname[ 0 ] if ($strFnameInit -like "[A-M]") { New-Item $strUHAM"\"$SmAccount -ItemType Directory } else { New-Item $strUHNZ"\"$SmAccount -ItemType Directory }
/\/\o\/\/ has a ton of stuff about working with acl/ssdl. I modified one of his scripts...
More of a technique thing but I would also suggest using a switch statement instead of an IF (much more elegant/FAST)
param ($sAMAccountName = $(Throw "$SAMAccountNAME is required!")) Begin { # AddRemove-AccessRule.MSH # Add or remove simple access rule to a file/directory # using text parameters # # Original written by /\/\o\/\/ 2006 # http://mow001.blogspot.com # # modified by tony 2006 # http://mshforfun.blogspot.com # # Stolen by Glenn 2008! # #Usage AddRemove-Acl FileOrDirectory (Action) user Rights (Access) # Action: Add / Remove # Rights: ListDirectory / ReadData / WriteData / CreateFiles / # CreateDirectories / AppendData / ReadExtendedAttributes / # WriteExtendedAttributes / Traverse / ExecuteFile / # DeleteSubdirectoriesAndFiles / ReadAttributes / WriteAttributes/ Write / # Delete / ReadPermissions / Read / ReadAndExecute / Modify / # ChangePermissions / TakeOwnership / Synchronize / FullControl # Access: Allow / Deny function Modify-ACL { param ( $FileDir, $User, [System.Security.AccessControl.FileSystemRights] $Rights = "Modify", [System.Security.AccessControl.AccessControlType] $Access = "Allow" ) trap{break} # get the current acl $AccessControl = get-acl $FileDir # create a new access control entry $AccessRule = new-object System.Security.AccessControl.FileSystemAccessRule($User,$Rights,$Access) # check if given user is Valid, this will break function if not so. $Sid = $AccessRule.IdentityReference.Translate([System.Security.Principal.securityidentifier]) # Add that New AC to the current ACL $AccessControl.AddAccessRule($AccessRule) # Overwrite the ACL with the new one we just made set-acl -aclobject $AccessControl -path $FileDir } } Process { # Match the first Character of the sAMAccountName using a regular expression. switch -regex ($sAMAccountName) { "^[a-f]" { New-Item "\\server1\privlun01$\home\"$sAMAccountName -ItemType Directory Modify-ACL -FileDir "\\server1\privlun01$\home\"$sAMAccountName -User $sAMAccountName } "^[g-l]" { New-Item "\\server1\privlun02$\home\"$sAMAccountName -ItemType Directory Modify-ACL -FileDir "\\server1\privlun02$\home\"$sAMAccountName -User $sAMAccountName } "^[m-s]" { New-Item "\\server1\privlun03$\home\"$sAMAccountName -ItemType Directory Modify-ACL -FileDir "\\server1\privlun03$\home\"$sAMAccountName -User $sAMAccountName } "^[t-z]" { New-Item "\\server1\privlun04$\home\"$sAMAccountName -ItemType Directory Modify-ACL -FileDir "\\server1\privlun04$\home\"$sAMAccountName -User $sAMAccountName Modify-ACL -FileDir "\\server1\privlun04$\home\"$sAMAccountName -User "BUILTIN\Administrator" -$Rights "FullControl" } } }
Hope that helps, ~Glenn
P.S. WooHoo I beat shay...
oops...
"^[a-f]" broken down... ^ dictates the first character, and [ - ] declares a range.
So "^[a-f]" will match any string that begins with a,A,b,B,c,C,d,D,e,E,f,F
~Glenn
I attached screenshots of errors I get in the console. The error1 is running it as a .ps1 by itself, then error2 is when I define the $sAMAccountName variable at the beginning with: $sAMAccountName = "dev-jcossota" error1: http://img241.imageshack.us/img241/3163/psherror1za6.jpg error2: http://img396.imageshack.us/img396/5421/psherror2fb0.jpg
Actually nevermind I got a co-worker of mine to look at it and he made some ammendments!
Thanks again!