Created
February 17, 2016 16:19
-
-
Save mortenya/5821bdd10bae15bac61a to your computer and use it in GitHub Desktop.
This is more of a POC on adding or editing ACLs via PowerShell. This will add the account 'NT AUTHORITY\System' to have FullControl access to the folder in question. This also is looking for a specific UNC, but that can easily be edited.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<# | |
.Synopsis | |
This Function will add "NT Authority\SYSTEM" to a folder ACL. | |
.DESCRIPTION | |
This Function will add "NT Authority\SYSTEM" to a folder ACL, specifically to \\folder\path\. | |
.EXAMPLE | |
Add-SystemToFolderACL \\folder\path\user1 | |
.EXAMPLE | |
Add-SystemToFolderACL user1,user2 | |
#> | |
function Add-SystemToFolderACL | |
{ | |
[CmdletBinding()] | |
Param | |
( | |
# Param1 help description | |
[Parameter(Mandatory=$true, | |
Position=0)] | |
[Alias('Folder')] | |
[string[]]$Path | |
) | |
Begin | |
{ | |
# settings to allow full control | |
$group = 'NT AUTHORITY\SYSTEM' | |
$rights = [System.Security.AccessControl.FileSystemRights]"FullControl" | |
$access = [System.Security.AccessControl.AccessControlType]::Allow | |
$inherit = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit" | |
$propagate = [System.Security.AccessControl.PropagationFlags]::None | |
$ace = New-Object System.Security.AccessControl.FileSystemAccessRule($group,$rights,$inherit,$propagate,$access) | |
} | |
Process | |
{ | |
foreach ($p in $Path) | |
{ | |
# Break if NT AUTHORITY\SYSTEM is already present | |
if ($p -like '\\folder\path\*' -and (Test-Path $p)) | |
{ | |
if (((get-acl $p).Access).IdentityReference -contains 'NT AUTHORITY\SYSTEM') { break } | |
$acl = Get-Acl $p | |
$acl.AddAccessRule($ace) | |
$acl.SetAccessRuleProtection($false,$false) # preserves inheritance ($true,$false) will disable inheritance | |
Set-Acl $p $acl | |
} | |
elseif (Test-Path "\\folder\path\$p") | |
{ | |
if (((get-acl "\\folder\path\$p").Access).IdentityReference -contains 'NT AUTHORITY\SYSTEM') { break } | |
$p = "\\folder\path\$p" | |
$acl = Get-Acl $p | |
$acl.AddAccessRule($ace) | |
$acl.SetAccessRuleProtection($false,$false) # preserves inheritance ($true,$false) will disable inheritance | |
Set-Acl $p $acl | |
} | |
else | |
{ | |
Write-Warning -Message "Path not found! Verify that the folder exists and is spelled correctly." | |
} | |
} | |
} | |
End{} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment