Exporting & Import Folder Structure and rigts with CSV file using PS Script

Question

I'm BRAND new to ps scripting and am looking for some advice please.

We replace a data share server every couple of years, and creating the complete folder structure and permissions by hand is very tedious, so I'm trying to automate it with a powershell script. Since I'm new I've been googling for some examples and snippets and have been compiling what I need from it.

My export script reads the folder structure and rites it to a text file, and my import script creates it once I move the folder over to new server, no problem. The problem comes with the access rights. It reads the rights and writes it to a CSV, but once I try to import it I get an error:

new-object : Cannot convert argument "2", with value: "TRUE", for "FileSystemAccessRule" to type "System.Security.AccessControl.AccessControlType": "Cannot convert value "TRUE" to type "System.Security.AccessControl.AccessControlType". Error: "Unable to match the identifier name TRUE to a valid enumerator name. Specify one of the following enumerator names and try again: Allow, Deny"" At line:1 char:23

• ... ccessRule = new-object System.Security.AccessControl.FileSystemAccess ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [New-Object], MethodException
  • FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand

As I understand it it's looking for a Allow/Deny and not a True/False, but the export gives a True/False. So I'm guessing there's something wrong with my export...

Here is my code if anyone could point me in the correct direction I would greatly appreciate it!! (Let me know if I should post ALL the code, I just don't want to clutter any more than I already do :D)

Export:

$FolderPath = dir -Directory -Path $DriveLetter -Force
$Report = @()
Foreach ($Folder in $FolderPath)
    {
        if ($Folder.Name -notlike '*$RECYCLE.BIN*')
        {
            
            if ($Folder.Name -notlike '*System Volume Information*')
            {          
                $Acl = Get-Acl -Path $Folder.FullName
                foreach ($Access in $acl.Access)
                {                        
                    $Properties = [ordered]@{'FolderName'=$Folder.Name;'IDRef'=$Access.IdentityReference;'FSRights'=$Access.FileSystemRights;'Inherited'=$Access.IsInherited}
                    $Report += New-Object -TypeName PSObject -Property $Properties                            
                }
            }
            
        }
            
    }
$Report | Export-Csv -path $ExportACL -NoTypeInformation

Import:

foreach ( $LItem in $ACL_Imp ) 
    {        
        $path_full = $Drivepath.ToString() + $LItem.FolderName
        $ACL_Set = Get-Acl $path_full
        $permission = $LItem.IDRef, $LItem.FSRights, $LItem.Inherited
        $accessRule = new-object System.Security.AccessControl.FileSystemAccessRule $permission <<<--- Error occurs here
        $ACL_Set.SetAccessRule($accessRule)        
        $ACL_Set | Set-Acl $path_full
    }

Example of one user in the export csv ( I remove the drive letter cause it isn't the same drive letter always.)

#TYPE System.Management.Automation.PSCustomObject;;; FolderName;IDRef;FSRights;Inherited Data\UserA;Domain\UserA;FullControl;FALSE Data\UserA;NT AUTHORITY\SYSTEM;FullControl;TRUE Data\UserA;DOMAIN\UserB;FullControl;TRUE Data\UserA;BUILTIN\Administrators;FullControl;TRUE Data\UserA;DOMAIN\GRP_A;ReadAndExecute, Synchronize;TRUE Data\UserA;Domain\GRP_A;ReadAndExecute, Synchronize;TRUE

Once again thanks in advance for any assistance! And if you can't provide any, thanx for taking the time to check it out anycase!! :)

Answer 1

I've changed the number of variables I export and import, and that seemed to do the trick. (Exporting all variables, and only using 5)

I'm posting my Full Code in case someone else also wants to use this, or want to modify for their needs :)

Hope this will help someone in the future, and that my comments make sense..

Our Directory structure:
ImportExport <-- Location of scripts and output files (whole folder to be copied to new server)
Shared
Software
Users/UserA/
Users/UserB/
....
Users/UserZ/

Export:

#Variables
$drivepath = Get-Location                                                        #Get working drives' letter
$DriveLetter = Split-Path -qualifier $drivepath
$ExportACL = $DriveLetter.ToString() + "\ImportExport\export_acl.csv"            #ACL Location
$ExportFolders = $DriveLetter.ToString() + "\ImportExport\export_folders.txt"    #File with List of Folders
$UsersPath = $DriveLetter.ToString() + "\Users"                                  #"Users" folders location on working drive located in Data folder

#Read user access levels on each folder on working drive and write to file.
cd.. #<-- add this if script is not run from within the PS environment.
$FolderPath = dir -Directory -Path $DriveLetter -Force
$Report = @()
Foreach ($Folder in $FolderPath)
    {
        if ($Folder.Name -notlike '*$RECYCLE.BIN*')
        {
            if ($Folder.Name -notlike '*ImportExport*')
            {
                if ($Folder.Name -notlike '*System Volume Information*')
                {          
                    $Acl = Get-Acl -Path $Folder.FullName
                    foreach ($Access in $acl.Access)
                    {                        
                        $Properties = [ordered]@{'FolderName'=$Folder.Name;'FSRights'=$Access.FileSystemRights;'ACType'=$Access.AccessControlType;'IDRef'=$Access.IdentityReference;'Inherited'=$Access.IsInherited;'IFlags'=$Access.InheritanceFlags;'PFlags'=$Access.PropagationFlags}
                        $Report += New-Object -TypeName PSObject -Property $Properties                            
                    }
                }
            }
        }            
    }
$Report | Export-Csv -path $ExportACL -NoTypeInformation

#Read user access levels on each child folder of Users folders on working drive and add to file.
$FolderPath = dir -Directory -Path $UsersPath -Force
$UserReport = @()
Foreach ($Folder in $FolderPath)
    {
        if ($Folder.Name -notlike '*$RECYCLE.BIN*')
        {
            if ($Folder.Name -notlike '*ImportExport*')
            {
                if ($Folder.Name -notlike '*System Volume Information*')
                {          
                    $Acl = Get-Acl -Path $Folder.FullName
                    foreach ($Access in $acl.Access)
                    {   
                        $StrFolderPath = $Folder.Parent.ToString() + "\" + $Folder.BaseName
                            
                        $Properties = [ordered]@{'FolderName'=$StrFolderPath;'FSRights'=$Access.FileSystemRights;'ACType'=$Access.AccessControlType;'IDRef'=$Access.IdentityReference;'Inherited'=$Access.IsInherited;'IFlags'=$Access.InheritanceFlags;'PFlags'=$Access.PropagationFlags}
                        $UserReport += New-Object -TypeName PSObject -Property $Properties                                                                                    
                    }
                }
            }
        }            
    }
$UserReport | Export-Csv -append $ExportACL


#Read Directory Structure and Export to File
$Dirs = Dir -Directory -Path $DriveLetter -Force
foreach($Dir in $Dirs)
    {
        if ($Dir.Name -notlike '*$RECYCLE.BIN*')
        {
            if ($Dir.Name -notlike '*ImportExport*')
            {
                if ($Dir.Name -notlike '*System Volume Information*')
                {          
                    $Dir.Name | out-file -Append $ExportFolders
                }
            }
        }
    }
$Dirs = Get-ChildItem -Path $UsersPath -Force
foreach($Dir in $Dirs)
    {
        $DirName = "Users\" + $Dir.Name
        $DirName | out-file -Append $ExportFolders
    }

Before import I open csv file in excel and make it different columns, so I use ";" as the delimiter, I'm struggling if I do not edit it. Variables with multiple values is split with a "," and that messes up the import.

Also, due to Admin rights needs to apply ACL, script needs to be run within elevated PS Environment, can't figure out how to do it outside. Can probably run a batch file to do a RunAs, but I had enough of this scripts for the time being. :p

Import:

#Variables
$drivepath = Get-Location                                                        #Get working drives' letter
$DriveLetter = Split-Path -qualifier $drivepath                                  
$ImportACL = $DriveLetter.ToString() + "\ImportExport\export_acl.csv"            #ACL Location
$ACL_Imp = Import-Csv $ImportACL -Delimiter ';'                                  #Import ACL
$ImportFolders = $DriveLetter.ToString() + "\ImportExport\export_folders.txt"    #File with List of Folders
$UsersPath = $DriveLetter.ToString() + "\Users"                                  #Users' folder location on working drive

#Create Folders from text file.
Get-Content $ImportFolders | %{mkdir "$DriveLetter\$_"}

#Apply ACL to created Folder structure
foreach ( $LItem in $ACL_Imp ) 
    {
        $path_full = $Drivepath.ToString() + $LItem.FolderName
        $ACL_Set = Get-Acl $path_full
        
             
        $permission = $LItem.IDRef, $LItem.FSRights, $LItem.IFlags, $LItem.PFlags, $LItem.ACType       
                    
        $accessRule = new-object System.Security.AccessControl.FileSystemAccessRule $permission
       
        $ACL_Set.SetAccessRule($accessRule)
        
        $ACL_Set | Set-Acl $path_full
    }