Powershell - 新用户主文件夹权限

Posted 2023-02-16

【中文标题】Powershell - 新用户主文件夹权限

【英文标题】：Powershell - New User home folder permissions

【发布时间】：2018-09-20 18:10:46

【问题描述】：

我正在编写一个 PS 脚本来自动化新的网络帐户、他们的主文件夹和交换邮箱。我们有多个域控制器，因此正在寻找一种在一个域控制器上创建网络帐户但在具有自己的域控制器的不同站点上创建主目录的方法。我已经尝试过了，但是在设置权限时出现了问题，因为该帐户尚未复制到另一个 DC。任何人有任何想法来解决这个问题？

新账户功能

Function New-BVStandardUser

    Param (
        $FirstName,
        $LastName,
        $CallRef,
        $SiteName,
        $EmployeeID,
        $ExpiryDate,
        $InternetAccess,
        $ExternalEmailAccess
    )

    $ImportGroups = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteGroups.csv" -Delimiter ","
    $ImportServers = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteServers.csv" -Delimiter ","
    $ImportOUs = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteOUs.csv" -Delimiter ","

    # Convert the first and last name so it does not have special characters for the email address/ UPN
    $LastNameEdit = $LastName -replace '[^a-zA-Z]', ''
    $FirstNameEdit = $FirstName -replace '[^a-zA-Z]', ''

    # Fetch a free username from AD based on the provided first and last name from the user
    $Username = Get-ADUsername -FirstName $FirstNameEdit -LastName $LastNameEdit

    # Generate a random password using the imported module
    $Password = Get-Randompassword  

    # Create the AD account based on the inputted fields
    $Params = @
        DisplayName = "$($LastName), $($FirstName)"
        DirectoryName = "$($LastName), $($FirstName)"
        SamAccountName = "$Username"
        UserPrincipalName = "$FirstNameEdit.$[e-mail]"
        Comment = "Created $($env:USERNAME) - $(Get-Date -Format dd/MM/yy) - $($CallRef)"
        GivenName = "$FirstNameEdit"
        Surname = "$LastNameEdit"
        Description = "$($SiteName) User"
        Enabled = $true
        ChangePasswordAtLogon = $true
        Path = "$ImportOUs.$($SiteName)"
        HomeDirectory = "\\$ImportServers.$($SiteName)\$Username$"
        HomeDrive = "U"
        AccountPassword = (ConvertTo-SecureString $Password -AsPlainText -Force)
    

    try
    
        New-ADUser @Params -ErrorAction Stop
        Write-Verbose -Verbose "Network Account Created"
    
    catch
    
        Write-Warning "Error creating network account. Error: $($_.Exception.Message)"
        break
    

新的 Home Drive 功能

Function New-BVUDrive

Param
(
    $Username,
    $Server
)

# Connect to the relevant server in CSV, create new folder, create new SMB Share for the user and add share/ NTFS permissions
    Invoke-Command -ComputerName $Server -ArgumentList $Username -ErrorAction Stop -ScriptBlock 
    
        param($Username)  

        $FindShare = (Get-SmbShare -Name Users$).Path

        if($FindShare -eq $true)
        

            try
            
                New-Item -ItemType Directory -Path "$FindShare\$Username" -ErrorAction Stop
                New-SmbShare -Name "$Username$" -Path "$FindShare\$Username" -FullAccess "AD\Server Admins", "AD\Domain Admins" -ChangeAccess "AD\$Username" -ErrorAction Stop

                $Acl = Get-Acl "$FindShare\$Username"

                foreach($Rule in $Acl.Access) 
                        
                    $Acl.RemoveAccessRule($Rule)
                

                $Ar = New-Object  system.security.accesscontrol.filesystemacces-s-rule("Everyone","FullControl","Allow") 
                $Acl.SetAccessRule($Ar)

                $Acl.SetAccessRuleProtection($false, $true)

                Set-Acl "$FindShare\$Username" $Acl -ErrorAction Stop
            
            catch
            
                Write-Warning "U drive failed to create. Error: $($_.Exception.Message)"
            
        
        else
        
            Write-Warning "Users$ share not found on server"
        
    

【参考方案1】：

您是否尝试过使用 SID？ 在第二个函数 New-BVUDrive 中，将用户名替换为 SID。并使用以下 cmdlet 获取 SID：

(Get-ADUser -Identity $SamAccountName).SID.Value

您现在可以设置 ACL，在数据复制之前，您将在安全选项卡中看到 SID，但如果用户尝试，他将能够访问该文件夹。

$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule ($SIDIdentity, 'FullControl', ('ContainerInherit','ObjectInherit'), 'None','Allow')

希望它会有所帮助。