Assign NTFS permission using Powershell via CSV

Question

I have a CSV file as below

Foldername---------- Securitygroup

Folder1---------- SG_Folder1-Access

Folder2---------- SG_Folder2-Access

I need to assign permissions like below,

so Security Group " SG_Folder1-Access " will have modify access on "Folder 1"

Security Group " SG_Folder2-Access " will have modify access on "Folder 2"

I have 500 folders and their own security group and need to create a power shell script to assign permissions.

Any help would be much appreciated.

Thanks

That doesn't look by any means like a csv [comma separated file](https://en.wikipedia.org/wiki/Comma-separated_values) If you have a real csv file you can use Import-csv, if necessary with a `-Delimiter ';'` and/or `-Header FolderName,SecurityGroup` parameter . — LotPings, Jul 05 '17 at 21:53

score 1 · Answer 1 · edited Jul 06 '17 at 10:57

You can try the following script:

$acl = Get-Acl "\\$servername\folderpath"

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("domain\user or usergroup","Modify", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Users","Modify", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)

Set-Acl "\\$servername\folderpath" $acl

Here are informative links for help. http://tomandersonpro.net/ntfs-permissions-with-powershell/

https://blogs.technet.microsoft.com/josebda/2010/11/12/how-to-handle-ntfs-folder-permissions-security-descriptors-and-acls-in-powershell/

score 0 · Answer 2 · answered Jul 05 '17 at 15:01

$CSV= Get-Content $CSVFileName
foreach ($line in $CSV) {
    $folder= $line.split(";")[0]
    $group= $line.split(";")[1]

    $acl= Get-Acl $folder
    $ar = New-Object system.security.accesscontrol.filesystemaccessrule($group,"Modify","Allow")
    $acl.SetAccessRule($ar)

    $Set-Acl $folder $acl
}

I haven't tested it but this is a basic idea. Try to improve it by yourself.

Also follow this links: Set-Acl Get-Acl MS Technet

score 0 · Answer 3 · answered Feb 06 '18 at 21:20

I've written a support methods that can help you achieve it in easy way.

function Remove-Permission($StartingDir, $UserOrGroup = "", $All = $false) {
    $acl = get-acl -Path $StartingDir
    if ($UserOrGroup -ne "") {
        foreach ($access in $acl.Access) {
            if ($access.IdentityReference.Value -eq $UserOrGroup) {
                $acl.RemoveAccessRule($access) | Out-Null
            }
        }
    } 
    if ($All -eq $true) {
        foreach ($access in $acl.Access) {
            $acl.RemoveAccessRule($access) | Out-Null
        }

    }
    Set-Acl -Path $folder.FullName -AclObject $acl
}
function Set-Inheritance($StartingDir, $DisableInheritance = $false, $KeepInheritedAcl = $false) {
    $acl = get-acl -Path $StartingDir
    $acl.SetAccessRuleProtection($DisableInheritance, $KeepInheritedAcl)
    $acl | Set-Acl -Path $StartingDir
}
function Set-Permission($StartingDir, $UserOrGroup = "", $InheritedFolderPermissions = "ContainerInherit, ObjectInherit", $AccessControlType = "Allow", $PropagationFlags = "None", $AclRightsToAssign) {
    ### The possible values for Rights are:
    # ListDirectory, ReadData, WriteData, CreateFiles, CreateDirectories, AppendData, Synchronize, FullControl
    # ReadExtendedAttributes, WriteExtendedAttributes, Traverse, ExecuteFile, DeleteSubdirectoriesAndFiles, ReadAttributes 
    # WriteAttributes, Write, Delete, ReadPermissions, Read, ReadAndExecute, Modify, ChangePermissions, TakeOwnership

    ### Principal expected
    # domain\username 

    ### Inherited folder permissions:
    # Object inherit    - This folder and files. (no inheritance to subfolders)
    # Container inherit - This folder and subfolders.
    # Inherit only      - The ACE does not apply to the current file/directory

    #define a new access rule.
    $acl = Get-Acl -Path $StartingDir
    $perm = $UserOrGroup, $AclRightsToAssign, $InheritedFolderPermissions, $PropagationFlags, $AccessControlType
    $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $perm
    $acl.SetAccessRule($rule)
    set-acl -Path $StartingDir $acl
}

Now if you were to use it... just loop thru csv entries and provide it to functions.

Full story is available on my website: https://evotec.xyz/manage-ntfs-permissions-powershell/

Assign NTFS permission using Powershell via CSV

3 Answers3