PowerShell 删除已删除 AD 用户帐户的文件夹权限

Question

在 AD 中删除用户后，他们的名称将更改为 S-X-XX-XXX

我有一个脚本来提取 S-X-XX-XXX 具有权限的所有文件夹，我要做的是获取该文件夹列表并删除所有 S-X-XX-XXX。

代码

<# The S-* is to represent the User ID that I am wanting to remove their folder permissions #>
$TargetUser = "S-*"
$TargetPath = "C:\Depts"

$Paths = get-childitem -path $TargetPath -Recurse -Directory
$FolderList = $Paths.FullName

ForEach ($Folder in $FolderList) {
    $ACL = Get-Acl -Path $Folder
    $ACLlist = $ACL.Access | where {$_.IdentityReference -like "*mike*"} 
    $RemoveUser = $ACLlist.IdentityReference

    if ($ACLlist.IdentityReference -like "$TargetUser") {
        Write-Host $Folder
        Write-Host $RemoveUser
        $ACE = New-Object System.Security.Accesscontrol.FileSystemAccessRule($RemoveUser, "None", "ContainerInherit,ObjectInherit", "InheritOnly", "Deny")
        $ACL.AddAccessRule($ACE)
        Set-Acl -Path $Folder -AclObject $ACL
    }
}

我找到了有关如何从另一个文件夹权限设置文件夹权限的代码，但是这是不是通过继承添加的用户。

我知道我缺少一些简单的东西，所以任何帮助都会很棒。

Folder Permissions

非常感谢所有回复的人，感谢你们抽出时间提供帮助。

Answer 1

问题的答案如下。

Clear
$TargetUser = Read-Host -Prompt "Enter the target account you are targeting [Full or Parital works]"
$RootPath = Read-Host -Prompt "Enter the root folder to start looking in and removing permissions"

$SubPaths = Get-ChildItem -Path $RootPath -Recurse -Directory
$SubFolderList = $SubPaths.FullName
$rootdone = $false
$FolderPurgeList = @()

if ($rootdone -eq $false) {
        $ACL = Get-Acl -Path $RootPath
        $ACLlist = $ACL.Access | where {$_.IdentityReference -like "*$TargetUser*"} 
        $RemoveUser = $ACLlist.IdentityReference

        $count = $RemoveUser.count 
            ForEach ($UserName in $RemoveUser ) {
                $UserID = New-Object System.Security.Principal.Ntaccount ($UserName)
                $ACL.PurgeAccessRules($UserID)
                $ACL | Set-Acl $RootPath

                $itemHasPerm = New-Object –TypeName PSObject
                    $itemHasPerm | Add-Member –MemberType NoteProperty –Name "Target User" -Value $UserName
                    $itemHasPerm | Add-Member –MemberType NoteProperty –Name "Folder Path" -Value $RootPath

                $FolderPurgeList += $itemHasPerm
                $count -= 1
        }
    if ($count -eq 0 ) {
    $rootdone = $true
    }
}

if ($rootdone -eq $true) {
    ForEach ($SubFolder in $SubFolderList) {
        $ACL = Get-Acl -Path $SubFolder
        $ACLlist = $ACL.Access | where {$_.IdentityReference -like "*$TargetUser*"} 
        $RemoveUser = $ACLlist.IdentityReference
            ForEach ($UserName in $RemoveUser ) {
                $UserID = New-Object System.Security.Principal.Ntaccount ($UserName)
                $ACL.PurgeAccessRules($UserID)
                $ACL | Set-Acl $SubFolder

                $itemHasPerm = New-Object –TypeName PSObject
                    $itemHasPerm | Add-Member –MemberType NoteProperty –Name "Target User" -Value $UserName
                    $itemHasPerm | Add-Member –MemberType NoteProperty –Name "Folder Path" -Value $SubFolder

                $FolderPurgeList += $itemHasPerm
        }
    }
}

$FolderPurgeList
$DateStamp = Get-Date -Format "dd-MMM-yyyy - hh-ss"
$FolderPurgeList | Export-CSV $env:USERProfile\Documents\Purged_Permission_List_$DateStamp.csv

Answer 2

你可以在acl中检查什么类型的用户登录，你不需要模板。而且你必须去每个文件夹中的每个访问规则来检查这个，因为removeaccesrule方法只接受一个对象时间。

$DebugPreference = 'Continue'
$TargetPath = "D:\testdir"
$Paths = get-childitem -path $TargetPath -Recurse -Directory
$FolderList = $Paths.FullName

ForEach ($Folder in $FolderList) {
    $ACLs = Get-Acl -Path $Folder
    foreach($acl in $ACLs.Access){
        If (($acl.IdentityReference -is [System.Security.Principal.SecurityIdentifier]) -and (-not $acl.IsInherited)){
        Write-Debug ("Removing ACl for {0}`r`n" -f $acl.IdentityReference.Value)
        [Void]$ACLs.RemoveAccessRule($acl)
        }
    }
Write-Debug ("Setting ACL for {0}`r`n" -f $folder.FullName)
Set-Acl -path $folder -aclObject $ACLs
}

我还有一个解决方案： 使用模块 ntfsSecurity(文件夹和文件管理manual) 列出所有无法再解析的权限。如果帐户不再可用，则通常会发生这种情况，因此权限显示为 SID 而不是帐户名称。

要删除所有不可解析或孤立的权限，您可以使用以下行。但要非常小心，因为可能由于网络问题，该帐户无法解析。

Install-Module -Name NTFSSecurity
dir -Recurse | Get-NTFSOrphanedAccess | Remove-NTFSAccess