My goal for this script was to:
- Create new folder
- Create AD group FS-TESTSHARE-R
- Create AD group FS-TESTSHARE-RW
- Apply both groups to the new share folder
- Set full read permissions to FS-TESTSHARE-R
- Set full read/Rights permissions to FS-TESTSHARE-RW
- Set full access permissions for local machine admins and domain admins
I've had a ton of help here and I really appreciate it. I've made some recommended changes based off Matt's answer here. So far I've decided to use read-host question and answer structure, but might eventually (after I've had some more practice) create parameters instead. I've also added some validation write-host statements to make sure my user can check their own writing. I've also done a lot of syntax cleanup and general structure change.
BTW, this script has come a long ways. THIS is what I started with... haha
Let me know what you think of this so far! Any other suggestions?
# File share server name
$Server = Read-Host -prompt "Verify Server Server Name (ie ECCOFS01)"
If ([string]::IsNullOrWhiteSpace($Server)) {
Write-Host "You entered $Server which is an incorrect value: This Script is now Exiting. `r`n" -Foreground "White" -Background "Red"
Exit
}
else {
Write-Host "You Entered $Server `r`n" -Foreground "Black" -Background "Yellow"
}
# Parent folder setup
$Parent = Read-Host -prompt "Enter full parent path that will contain the new folder (ie. \Groups\ECCO IT). Please use correct spelling and capitalization (ie. Parent Folder Name). Do not use local drive letters."
If ([string]::IsNullOrWhiteSpace($Parent) -or ($Parent -like '*:*')) {
Write-Host "You entered $Parent which is an incorrect value: This Script is now Exiting. `r`n" -Foreground "White" -Background "Red"
Exit
}
else {
Write-Host "You Entered $Parent `r`n" -Foreground "Black" -Background "Yellow"
}
# Set additional variables
# $Parent removes any extra backslashes if the user adds one in the front of the answer to $Parent
$Parent = $Parent -replace '^\\',''
$ServerParentShare = "\\"+[IO.Path]::Combine($Server,$Parent)
# New Folder Name
$Name = Read-Host -prompt "Enter New Folder Name. Please use correct spelling and capitalization (ie. New Test Folder)"
If ([string]::IsNullOrWhiteSpace($Name)) {
Write-Host "You entered $Name which is an incorrect value: This Script is now Exiting. `r`n" -Foreground "White" -Background "Red"
Exit
}
else {
Write-Host "You Entered $Name. `r`n" -Foreground "Black" -Background "Yellow"
}
$Path = [IO.Path]::Combine($ServerParentShare,$Name)
Write-Host "New Folder Path = $Path `r`n" -Foreground "Black" -Background "Yellow"
# Choose Parent OU
$Country = Read-Host -prompt "Enter the location where the AD Group needs to be added (i.e. Global, Americas, Europe, Asia Pacific)"
If ([string]::IsNullOrWhiteSpace($Country)) {
Write-Host "You entered $Country which is an incorrect value: This Script is now Exiting. `r`n" -Foreground "White" -Background "Red"
Exit
}
else {
Write-Host "---------------------VERIFY ENTRY---------------------" -Foreground "Black" -Background "Yellow"
Write-Host "OU = $Country, New share location = $Path `r`n" -Foreground "Black" -Background "Yellow"
}
# Option to continue or cancel the script
$Continue = Read-Host -prompt "Does this look correct? Y or N?"
If (($Continue -eq "N") -or ($Continue -eq "No")) {
Write-Host "Please Start over. This Script is now Exiting. `r`n" -Foreground "White" -Background "Red"
Exit
}
else {
Write-Host "Make sure to verify all folders and and AD Groups once complete. `r`n" -Foreground "Yellow" -Background "Black"
}
#Ensure ActiveDirectory module is imported
Import-Module ActiveDirectory
#Set additional values based off of answers to the previous questions. This allows the correct formatting to be used.
$FileShareFull = $Server -replace '\s'
$NameFull = $NAME -replace '[\s_\\]+'
$ADNameRO = "FS-$FileShareFull-$NameFull-RO".toupper()
$ADNameRW = "FS-$FileShareFull-$NameFull-RW".toupper()
$ADGroupPath = $Path.toupper()
# Create Security Groups =
# Creates the parameters for the new groups
# Capitalizes and removes spaces from the answer to $Name
# Adds a description to each AD Group
# Creates the Security Groups in the appropriate Active Directory OU based off of the answser to $Country
$GroupParams1= @{
'Name' = $ADNameRW
'SamAccountName' = $ADNameRW
'GroupCategory' = "Security"
'GroupScope' = "Global"
'DisplayName' = "$NAME Read-Write Access"
'Path' = "OU=$Country,OU=FILE SHARE GROUPS,OU=Security Groups,DC=esg,DC=intl"
'Description' = "Members of this group have read-write access to $ADGroupPath"
}
New-ADGroup @GroupParams1
$GroupParams2= @{
'Name' = $ADNameRO
'SamAccountName' = $ADNameRO
'GroupCategory' = "Security"
'GroupScope' = "Global"
'DisplayName' = "$NAME Read-Write Access"
'Path' = "OU=$Country,OU=FILE SHARE GROUPS,OU=Security Groups,DC=esg,DC=intl"
'Description' = "Members of this group have read access to $ADGroupPath"
}
New-ADGroup @GroupParams2
# Create New Share Folder
New-Item -Path $Path -ItemType Directory | Out-Null
# Create initial ACE
# Create the initial Object
# Set domain - This could also be changed to prompt for domain if we decide it is needed
# Define local Administrators group by Well Known SID
# Set additional ACEs for the new AD File Share Groups
# Set ACLs on the new folder
function New-Ace {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true, Position=0)]
[Security.Principal.NTAccount]$Account,
[Parameter(Mandatory=$false, Position=1)]
[Security.AccessControl.FileSystemRights]$Permissions = 'ReadAndExecute',
[Parameter(Mandatory=$false, Position=2)]
[Security.AccessControl.InheritanceFlags]$InheritanceFlags = 'ContainerInherit,ObjectInherit',
[Parameter(Mandatory=$false, Position=3)]
[Security.AccessControl.PropagationFlags]$PropagationFlags = 'NoPropagateInherit',
[Parameter(Mandatory=$false, Position=4)]
[Security.AccessControl.AccessControlType]$Type = 'Allow'
)
New-Object Security.AccessControl.FileSystemAccessRule(
$Account, $Permissions, $InheritanceFlags, $PropagationFlags, $Type
)
}
$domain = 'ESG.INTL'
$administrators = ([wmi]"Win32_Sid.Sid='S-1-5-32-544'").AccountName
$ADDomainUsers = "$domain\Domain Users"
$acl = Get-Acl $path
$administrators, "$domain\Domain Admins" | ForEach-Object {
$acl.AddAccessRule((New-Ace $_ 'FullControl'))
}
$acl.AddAccessRule((New-Ace $ADNameRW 'Modify'))
$acl.AddAccessRule((New-Ace $ADNameRO 'ReadAndExecute'))
$acl.AddAccessRule((New-Ace $ADDomainUsers 'ReadAndExecute'))
$acl.SetAccessRuleProtection($True, $False)
Set-Acl $path $acl
