我有一个文件夹有很多的子文件夹
我需要像这样为每个子文件夹创build三个活动目录组。
在完成之后，我必须映射文件夹，Activedirectory组和权限。
设置权限是困难的部分。 这是我有多远。 我不知道如何将组绑定到权限，然后将其应用到文件夹。
$SharePath = "\\fs\data\" $FSGroupPath = "OU=GROUPS,OU=Data,DC=DOMAIN,DC=LOCAL" Get-ChildItem $SharePath | ForEach-Object { $GroupNameRead = "FS_Data-" + $_ + "_Read" $GroupNameChange = "FS_Data-" + $_ + "_Change" $GroupNameFull = "FS_Data-" + $_ + "_Full" New-ADGroup -Name $GroupNameRead -DisplayName $GroupNameRead -GroupScope DomainLocal -GroupCategory Security -Path $FSGroupPath -Description "Ger Läs Rättigheter till sökväg: FS\Data\$_" New-ADGroup -Name $GroupNameChange -DisplayName $GroupNameChange -GroupScope DomainLocal -GroupCategory Security -Path $FSGroupPath -Description "Ger Ändra Rättigheter till sökväg: FS\Data\$_" New-ADGroup -Name $GroupNameFull -DisplayName $GroupNameFull -GroupScope DomainLocal -GroupCategory Security -Path $FSGroupPath -Description "Ger Fulla Rättigheter till sökväg: FS\Data\$_" $set_Group = $GroupNameFull $set_rights = Modify $acl = Get-Acl $SharePath $permission = $set_user,$set_rights,"Allow" $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission $acl.SetAccessRule($accessRule) $acl | Set-Acl $SharePath } 在New-ADGroup cmdlet上指定-PassThru参数时，将返回新组。 您获取的ADGroup对象包含一个SID属性，您可以使用该属性为访问规则传递IdentityReference ：
$readGroup = New-ADGroup -Name $GroupNameRead -DisplayName $GroupNameRead -GroupScope DomainLocal -GroupCategory Security -Path $FSGroupPath -Description "Ger Läs Rättigheter till sökväg: FS\Data\$_" -PassThru if(-not($readGroup)) # Make sure it got created, if not, handle the error { # Error handling in here } else { $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($readGroup.SID,Read,Allow) }
看看这个来自Don Jones的例子是否可以帮助你：你基本上从文件夹中取出现有的acl对象，向它添加一个新的规则（SetAccessRule），规则包含委托人（用户或组），权限以及是否允许拒绝）。 然后使用set-acl将更新后的aclobject应用于文件/文件夹。
#ChangeACL.ps1 $Right="FullControl" #The possible values for Rights are # ListDirectory, ReadData, WriteData # CreateFiles, CreateDirectories, AppendData # ReadExtendedAttributes, WriteExtendedAttributes, Traverse # ExecuteFile, DeleteSubdirectoriesAndFiles, ReadAttributes # WriteAttributes, Write, Delete # ReadPermissions, Read, ReadAndExecute # Modify, ChangePermissions, TakeOwnership # Synchronize, FullControl $StartingDir=Read-Host "What directory do you want to start at?" $Principal=Read-Host "What security principal do you want to grant" ` "$Right to? `n Use format domain\username or domain\group" #define a new access rule. #note that the $rule line has been artificially broken for print purposes. #it needs to be one line. the online version of the script is properly #formatted. $rule=new-object System.Security.AccessControl.FileSystemAccessRule($Principal,$Right,"Allow") foreach ($file in $(Get-ChildItem $StartingDir -recurse)) { $acl=get-acl $file.FullName #Add this access rule to the ACL $acl.SetAccessRule($rule) #Write the changes to the object set-acl $File.Fullname $acl }