在远程服务器上执行 icacls 命令答案

【问题标题】：Execute icacls command on remote servers在远程服务器上执行 icacls 命令
【发布时间】：2022-01-27 22:31:16
【问题描述】：

下面是我拥有的代码，在为单个服务器运行时可以完美执行


$Hostname = $env:COMPUTERNAME
$CsvData = Import-Csv -Path "C:\Ansible\status_report_2021.csv" | Where-Object{$_.ServerName -eq $Hostname} | Select-Object SystemFolderPath

foreach($path in $CsvData)
{

$path = $path.SystemFolderPath
$path = $path.trim('\')

# break inheritance on the folder and copy ACEs as uninherited
icacls $path /inheritance:d

#remove all BUILTIN\Users granted ACEs
icacls $path /remove:g BUILTIN\Users

#grant only BUILTIN\Users Read&Execute. avoid using (S,GE,GR) = RX.
#(S,GE,GR) is a specific right and icacls would create 2 ACEs.
#same meaning but if we can avoid it's better
icacls $path /grant:r "BUILTIN\Users:(OI)(CI)RX"

#remove SYSTEM
icacls $path /remove:g "NT AUTHORITY\SYSTEM"

#grant SYSTEM as Full control on "this folder, subfolder and files"
icacls $path /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"

icacls $path

}

请告诉我如何为远程服务器执行这些 icacls 命令。

【问题讨论】：

CSV 报告中的ServerName 列（或其他一些列）是否包含有效的 FQDN？
ServerName 将与 $env:COMPUTERNAME 相同，如 A92XXXXXXXXX1AP

标签： powershell acl

【解决方案1】：

我想您可以使用Group-Object 的组合将所有服务器名称及其在 csv 中的SystemFolderPath 条目组合在一起，然后循环遍历这些组。

在循环内部使用Invoke-Command 让icacls 命令在每个服务器上执行。

类似

Import-Csv -Path "C:\Ansible\status_report_2021.csv" | Group-Object ServerName | ForEach-Object {
    $server = $_.Name
    foreach ($path in ($_.Group.SystemFolderPath | Select-Object -Unique)) {
        Invoke-Command -ComputerName $server -ScriptBlock {
            param ([string]$path)
            # break inheritance on the folder and copy ACEs as uninherited
            icacls $path /inheritance:d

            # remove all BUILTIN\Users granted ACEs
            icacls $path /remove:g BUILTIN\Users

            # grant only BUILTIN\Users Read&Execute. avoid using (S,GE,GR) = RX.
            # (S,GE,GR) is a specific right and icacls would create 2 ACEs.
            # same meaning but if we can avoid it's better
            icacls $path /grant:r "BUILTIN\Users:(OI)(CI)RX"

            # remove SYSTEM
            icacls $path /remove:g "NT AUTHORITY\SYSTEM"

            # grant SYSTEM as Full control on "this folder, subfolder and files"
            icacls $path /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"

            icacls $path
        } -ArgumentList $path.Trim('\')
    }
}

【讨论】：

感谢您的回复。一件事，在 Invoke-Command 中我们也需要 Credential 对吗？
@EmptyCoder 可能是的，除非您碰巧是域管理员。否则，使用-Credential 为用户提供服务器上的管理员权限

【解决方案2】：

首先按服务器对所有 CSV 条目进行分组 - 这样我们可以一次将所有受影响的路径发送到每个单独的服务器：

$PathsPerServer = Import-Csv -Path "C:\Ansible\status_report_2021.csv" | Group-Object ServerName

现在我们可以对每个不同的服务器使用 Invoke-Command 并为每个相关路径执行 icacls 语句：

$PathsPerServer | ForEach-Object {
    # enumerate all the paths for this server, we need to pass them as arguments to Invoke-Command
    $paths = $_.Group | Select-Object -Expand SystemFolderPath | ForEach-Object Trim

    Invoke-Command -ComputerName $_.Name -ScriptBlock {
        param([string[]]$Paths)

        foreach ($path in $Paths) {
            # break inheritance on the folder and copy ACEs as uninherited
            icacls $path /inheritance:d

            #remove all BUILTIN\Users granted ACEs
            icacls $path /remove:g BUILTIN\Users

            #grant only BUILTIN\Users Read&Execute. avoid using (S,GE,GR) = RX.
            #(S,GE,GR) is a specific right and icacls would create 2 ACEs.
            #same meaning but if we can avoid it's better
            icacls $path /grant:r "BUILTIN\Users:(OI)(CI)RX"

            #remove SYSTEM
            icacls $path /remove:g "NT AUTHORITY\SYSTEM"

            #grant SYSTEM as Full control on "this folder, subfolder and files"
            icacls $path /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"

            icacls $path
        }
    } -ArgumentList $paths
}

【讨论】：