Removing multiple users at once from ACL Powershell

spiceuser-84hdj · 2021-10-07T20:46:58.000Z

So, on our main fileserver where all the shares are (D:\Data) we have inheritance turned on.
I have made a script that creates a new folder, creates a share, creates AD groups & creates a DFSN folder etc etc.

The only problem is, that with this inheritance on the D:\data, every single admin that goes in to D:\data gets full access on every folder that gets created. My script removes evey adm user that currently has access manualy. The only problem is everytime someone goes in to D:\Data they get access to new folders, I would have to modify the script. Could someone help me nail a For Each loop that gets rid of all of them. They all start with “Domain\adm”

With a variable simular to this? $users = Get-Acl “D:\Data\Testtest” | select Path -ExpandProperty Access | where {$_.IdentityReference -like " domain\adm*"} | fl

Se the part of the script that I want to optimize:

Rights

$readOnly = [System.Security.AccessControl.FileSystemRights]“ReadAndExecute”
$readWrite = [System.Security.AccessControl.FileSystemRights]“Modify”

Inheritance

$inheritanceFlag = [System.Security.AccessControl.InheritanceFlags]“ContainerInherit, ObjectInherit”

Propagation

$propagationFlag = [System.Security.AccessControl.PropagationFlags]::None

User

$userRW = New-Object System.Security.Principal.NTAccount($groupNameRW)
$userR = New-Object System.Security.Principal.NTAccount($groupNameR)
$RemoveAcl = Get-Acl “D:\Data\Testtest” | select Path -ExpandProperty Access | where {$_.IdentityReference -like “Marginalen\adm*”} | fl

Type

$type = [System.Security.AccessControl.AccessControlType]::Allow

Creating one entry for every user

$accessControlEntryDefault = New-Object System.Security.AccessControl.FileSystemAccessRule @(“Domain\adm1” , $readOnly, $inheritanceFlag, $propagationFlag, $type)
$accessControlEntryDefault2 = New-Object System.Security.AccessControl.FileSystemAccessRule @(" Domain\admuser2 " , $readOnly, $inheritanceFlag, $propagationFlag, $type)
$accessControlEntryDefault3 = New-Object System.Security.AccessControl.FileSystemAccessRule @(" Domain\admuser 3" , $readOnly, $inheritanceFlag, $propagationFlag, $type)
$accessControlEntryDefault4 = New-Object System.Security.AccessControl.FileSystemAccessRule @(" Domain\user4 " , $readOnly, $inheritanceFlag, $propagationFlag, $type)
$accessControlEntryDefault5 = New-Object System.Security.AccessControl.FileSystemAccessRule @(" Domain\ adm user5 " , $readOnly, $inheritanceFlag, $propagationFlag, $type)
$accessControlEntryDefault6 = New-Object System.Security.AccessControl.FileSystemAccessRule @(" Domain\ adm user6 " , $readOnly, $inheritanceFlag, $propagationFlag, $type)
$accessControlEntryDefault7 = New-Object System.Security.AccessControl.FileSystemAccessRule @(" Domain\ adm user7" , $readOnly, $inheritanceFlag, $propagationFlag, $type)
$accessControlEntryDefault8 = New-Object System.Security.AccessControl.FileSystemAccessRule @( Domain\admuser 8" , $readOnly, $inheritanceFlag, $propagationFlag, $type)

$accessControlEntryDefaul9 = New-Object System.Security.AccessControl.FileSystemAccessRule @(“$RemoveAcl” , $readOnly, $inheritanceFlag, $propagationFlag, $type)

$accessControlEntryRW = New-Object System.Security.AccessControl.FileSystemAccessRule @($userRW, $readWrite, $inheritanceFlag, $propagationFlag, $type)
$accessControlEntryR = New-Object System.Security.AccessControl.FileSystemAccessRule @($userR, $readOnly, $inheritanceFlag, $propagationFlag, $type)
$objACL = Get-ACL $newFolderFull

##hör ihop med rad 48 (hitta bättre lösning)
$objACL.RemoveAccessRuleAll($accessControlEntryDefault)
$objACL.RemoveAccessRuleAll($accessControlEntryDefault2)
$objACL.RemoveAccessRuleAll($accessControlEntryDefault3)
$objACL.RemoveAccessRuleAll($accessControlEntryDefault4)
$objACL.RemoveAccessRuleAll($accessControlEntryDefault5)
$objACL.RemoveAccessRuleAll($accessControlEntryDefault6)
$objACL.RemoveAccessRuleAll($accessControlEntryDefault7)
$objACL.RemoveAccessRuleAll($accessControlEntryDefault8)
$objACL.AddAccessRule($accessControlEntryRW)
$objACL.AddAccessRule($accessControlEntryR)
Set-ACL $newFolderFull $objACL
}

Makes sence?!

Neally · 2021-10-07T21:12:50.000Z

Welcome

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

192033ab-bb8f-4032-88a5-8e2313af0344-codebutton_small.png

Neally Bot

Neally · 2021-10-07T21:21:42.000Z

If you ask me, the ‘set-acl’ cmdlets are a pain in the neck.

There is the PowerShell Gallery | NTFSSecurity 4.2.6 NTFS module in the Gally OR I stick to just ICACLS

$path = "D:\Data\Testtest"

$users = 
(Get-Acl $path).access |
where-object {$_.IdentityReference -like "domain\adm*"} 

foreach($user in $users){
    ICACLS ("$path") /remove ("domain\$user" + ':(OI)(CI)F') /T
}

spiceuser-84hdj · 2021-10-08T07:33:56.000Z

Thank you Very much for the response, I tried ICALs but nothing happens, se the return code:

Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files
Successfully processed 0 files; Failed processing 0 files

Neally · 2021-10-08T07:34:54.000Z

Post your code please.

spiceuser-84hdj · 2021-10-08T07:35:35.000Z

$path = "D:\Data\Testtest"

$users = 
(Get-Acl $path).access |
where-object {$_.IdentityReference -like "domain\adm*"} 

foreach($user in $users){
    ICACLS ("$path") /remove ("domain\$user") + ':(OI)(CI)F' /T}

Here: