Question

我编写了一个脚本，根据一些公司变量创建一个新文件夹，然后添加一个用户组来处理该文件夹的权限。我找不到将一个或多个AD组添加到同一脚本中的文件夹的合适方法。

这是我的剧本：

$parentfolder = Read-Host -Prompt "Please enter the name of the parent folder (i.e. FOLDER1234)"
$folder = Read-Host -Prompt "Please enter the name of the new network folder"

New-Item \\DC02\product\$parentfolder\$folder -type directory
Write-Host "Folder has been created!"
Start-Sleep -s 2

$newgroup = Read-Host -Prompt "Please enter the new group name for this folder (1234-1234-12xx format)"
$description = Read-Host -Prompt "Please enter the abbreviation of the product (i.e. PDPROD)"
NEW-ADGroup -Name $newgroup -GroupScope Global -Description $description -Path "OU=Project Groups,DC=ourdomain,DC=nl"

do {
    $stringquit = Read-Host -Prompt "Please enter the member username's to add or press Q if you are done."
    $userfilter3 = Get-ADUser -Filter {sAMAccountName -eq $stringquit}
    if ($userfilter3 -eq $Null,"Q") {
        Write-Host = "User does not exist in AD, please try again"
        Start-Sleep -s 1
    } else {
        if ($stringquit -ne "Q") {
            Write-Output -InputObject $stringquit | Out-File -Append  c:\userlist.csv
        } else {
            Write-Host "You pressed Q, moving on."
        }
    }
} until ($stringquit -eq "Q")

$addgroup = "cn=$newgroup,ou=Project Groups,dc=ourdomain,dc=nl"
$list = Get-Content c:\userlist.csv
foreach ($user in $list) {
    Add-ADGroupMember -Identity $addgroup -Member $user
}

#set permissions
$acl = Get-Acl \\DC02\product\$parentfolder\$folder
$ar = New-Object System.Security.AccessControl.FileSystemAccessRule("1234-all","Modify"."ContainerInherit,ObjectInherit","None","Allow")
$acl.SetAccessRule($ar)
Set-Acl \\DC02\product\$parentfolder\$folder $acl

Answer 1

将SetAccessRule()替换为AddAccessRule()。

尝试将全局安全组添加到文件夹

1 个答案: