NewSmbShare and acces rights

[cerberesb]

Hi everyone.

Im trying to make an interactive powershell script to add an user on the Active Directory and to map a personnal folder to this current user.
I’ve started from scratch since im currently learning powershell and im not english fluent so be nice with me ^^
I’ve managed to make my script work (the user is created , the new folder is created)
BUT
I realised that not only my user can acces his personnal folder but EVERYONE
So that’s a big problem (since it’s a PERSONNAL folder haha)
I’ve made some research on internet but i cant figure it out.
I think there is a right problem but i dont know what problem.
Once the folder is created by the script i can clearly see that my smb share is shared to the “Domains Members” as attached in the picture .

Can you help me please?
Below here is my script

##############################################################################################################################################
#Auteur     : Marc 
#Date       : 30/05/22
#Version    : 1.2
#Titre      : Script interactif de création d'un utilisateur dans l'Active Directory
#Description: Ce script permet d'ajouter un utilisateur dans l'Active Directory et de lui créer un dossier sur le serveur.
#             Les informations prises en compte sont les suivantes : PRENOM
#                                                                    NOM
#                                                                    NOM COMPLET
#                                                                    ADRESSE DE MESSAGERIE
#                                                                    DEPARTEMENT OU REGION
#                                                                    UPN
#                                                                    SAMAccountName
#                                                                    FONCTION
#                                                                    SERVICE
#                                                                    SOCIETE
#
#Revisions  : 01/06/22 : Ajout d'un bloc Try Catch pour gérer les utilisateurs déja crées
#             01/06/22 : Ajout d'un bloc Try Catch pour gérer les OU non existantes ou mal ortographiées
#             01/06/22 : Ajout de la création d'un dossier, de son partage et de la configuration des droits du propriétaire.
##############################################################################################################################################
Write-Host " Bienvenue. Ce script vous permet d'ajouter un utilisateur dans l'Active Directory et de lui attribuer un dossier personnel stocké sur le serveur" -ForegroundColor Green

try
{
#Ouverture du bloc DO/WHILE pour enchainer la création d'users
do{

Import-Module ActiveDirectory

#Definition des variables
$givenname = Read-Host "Prénom de l'utilisateur a ajouter"
$surname = Read-Host "Nom de l'utilisateur a ajouter"
$sam = $givenname.Substring(0,1)+"." +$surname.ToLower()   #permets de récuperer la premiere lettre du prénom, de la mettre en majuscule,d'ajouter un point et de recuperer le nom (ex : a.dupont)
$upn = $givenname.tolower().substring(0,1)+ "." + $surname.ToLower() + "@"+ "axeplane.loc" #idem en rajoutant le suffixe @axeplane.loc#
$Mail= $givenname.tolower().substring(0,1)+ "." + $surname.ToLower() + "@"+ "axeplane.loc"
$poste = Read-Host "Renseignez le poste occupé par l'utilisateur"
$service = Read-Host "Renseignez le service de l'utilisateur"
$OU = $service
$login = $givenname.Substring(0,1).ToLower() +"."+$surname.ToLower() 
$msg = "L utilisateur a été correctement ajouté,voulez vous ajouter un autre utilisateur dans l'Active Directory? [O/N]"  #cette variable permets d'appeler le message du DO/WHILE#
$msg1 = "Souhaitez vous ajouter l'utilisateur a un autre groupe de sécurité ? [O/N] "
$fullPath = "\\SRV22PARAP\Users\$login$"
$homeShare = New-Item -path $fullPath -ItemType Directory -force 

#Création de l'user dans l'Active Directory

New-ADUser        -Name "$givenname $surname" `
                  -GivenName $givenname `
                  -Surname $surname `
                  -Path  "OU=$OU,dc=axeplane,dc=loc"`
                  -Enabled $true `
                  -SamAccountName $sam.ToLower() `
                  -UserPrincipalName $upn `
                  -AccountPassword (Read-Host -AsSecureString "Veuillez renseigner le mot de passe de l'utilisateur") `
                  -Company "Axeplane" `
                  -Title $poste `
                  -State "France" `
                  -Department $service `
                  -DisplayName "$givenname $surname" `
                  -HomeDrive "Z:" `
                  -HomeDirectory "\\SRV22PARAP\Users\$login" `
                  -EmailAddress $Mail `

            do{

$Groupe = Read-Host "Renseignez le groupe de sécurité. Choisir parmi cette liste : Service Informatique / Marketing / Direction / Finance / RH / Logistique / Commercial / Stagiaires  "
$msg1 = "Souhaitez vous ajouter l'utilisateur a un autre groupe de sécurité ? [O/N] "
$responsegroup = Read-Host -Prompt  "$msg1" `

            Add-ADGroupMember -Identity $Groupe -Members $login
                
            

    }     

    while ($responsegroup -eq "O")

                  
                  

#Mise en place du partage du dossier crée avec l'utilisateur
new-SmbShare -Name $Login$ -Path "E:\Users\$Login$"  

Grant-SmbShareAccess -Name $login$ -AccountName $login -AccessRight Full

#Prompt d'un message pour créer un autre utilisateur                
$response = Read-Host -Prompt  "$msg" `
}
while ($response -eq "O")
#Si la réponse a la question est O , alors le script reviens au debut, sinon il s'arrete.

}

catch [Microsoft.ActiveDirectory.Management.ADIdentityAlreadyExistsException]
{ Write-Host " L'utilisateur existe déja dans l'Active Directory" -ForegroundColor Red

}

catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException]
{ Write-Host "OU inexistante ou mal ortographiée" -ForegroundColor Red
}

catch [Microsoft.ActiveDirectory.Management.ADPasswordComplexityException]
{Write-Host "Le mot de passe ne répond pas aux spécifications de longueur, de compléxité ou d'historique du domaine" -ForegroundColor Red
}

[Neally]

@cerberesb

$fullPath = “\SRV22PARAP\Users$login$”
$homeShare = New-Item -path $fullPath -ItemType Directory -force

You are just creating the folder, the folder will inherit whatever permissions are set in the parent folder by default.

You should disable inheritance for the folder and add access only to like a domain admin/backup account and the user himself.

SET-ACL - Set-Acl (Microsoft.PowerShell.Security) - PowerShell | Microsoft Learn

In general, authenticated users should have SHARE permissions but lock the folder down with NTFS permissions (ACLs)

It looks like you share each individual folder, why is that?

[cerberesb]

Hi Neally and first of all thank you for your help

Indeed, my USER folder (where the personnal folder will be created by the script) was shared to “Domains Users” you’re right
But when i remove this permission , after starting the script , the personnal folder is created BUT when i connect this user on his session, the personnal drive doesnt show up (this was the reason i had set the USER folder permissions to “domains users”

I checked if inheritance was disabled for this folder but it seem to be already disabled

(as shown in my screenshot below)

[gary-m-g]

Here’s how I’ve been using icacls.exe within PowerShell to create user home drives for several years.
I know invoke-expression is frowned upon, but in my proprietary enclave wherein there’s no internet access at all, I’m not concerned.

All the variables used herein are defined earlier in the overall script.
This is merely the section which lays down the specific permissions for the new user’s Home drive:

$dir = $UserFolder
$cP1 = "icacls $dir /grant "
$cp2 = $LoginName
$cp3 = ':`(OI`)`(CI`)M /T'
$cmdStr = $cP1 + $cp2 + $cp3
invoke-expression $cmdStr

[cerberesb]

I have found a very usefull ressource thank to you :

Change File/Folder permissions with Powershell

This video explains very well how works the commande SET ACL
I’ve managed to make it work with a simple file just to test
Now i need to make it work into my own AD Script

@garygreenberg since i’m know beginning to understand this way of doing it, i will try this way.
But thank you so much to giving me another way to do it