Question

我正在使用PS脚本来自动化新的网络帐户，其主文件夹和交换邮箱。我们有多个域控制器，因此我正在寻找一种在一个域控制器上创建网络帐户，但在具有自己的域控制器的不同站点上创建主目录的方法。我已经尝试过了，但是在设置权限时出现了问题，因为该帐户尚未复制到其他DC。任何人都有解决这个问题的想法吗？

新帐户功能

Function New-BVStandardUser
{
    Param (
        $FirstName,
        $LastName,
        $CallRef,
        $SiteName,
        $EmployeeID,
        $ExpiryDate,
        $InternetAccess,
        $ExternalEmailAccess
    )

    $ImportGroups = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteGroups.csv" -Delimiter ","
    $ImportServers = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteServers.csv" -Delimiter ","
    $ImportOUs = Import-Csv -Path "\\UKSP-FS01\Lawsonja$\Scripts\New-ADUser\SiteOUs.csv" -Delimiter ","

    # Convert the first and last name so it does not have special characters for the email address/ UPN
    $LastNameEdit = $LastName -replace '[^a-zA-Z]', ''
    $FirstNameEdit = $FirstName -replace '[^a-zA-Z]', ''

    # Fetch a free username from AD based on the provided first and last name from the user
    $Username = Get-ADUsername -FirstName $FirstNameEdit -LastName $LastNameEdit

    # Generate a random password using the imported module
    $Password = Get-Randompassword  

    # Create the AD account based on the inputted fields
    $Params = @{
        DisplayName = "$($LastName), $($FirstName)"
        DirectoryName = "$($LastName), $($FirstName)"
        SamAccountName = "$Username"
        UserPrincipalName = "$FirstNameEdit.$LastNameEdit@Bakkavor.com"
        Comment = "Created $($env:USERNAME) - $(Get-Date -Format dd/MM/yy) - $($CallRef)"
        GivenName = "$FirstNameEdit"
        Surname = "$LastNameEdit"
        Description = "$($SiteName) User"
        Enabled = $true
        ChangePasswordAtLogon = $true
        Path = "$ImportOUs.$($SiteName)"
        HomeDirectory = "\\$ImportServers.$($SiteName)\$Username$"
        HomeDrive = "U"
        AccountPassword = (ConvertTo-SecureString $Password -AsPlainText -Force)
    }

    try
    {
        New-ADUser @Params -ErrorAction Stop
        Write-Verbose -Verbose "Network Account Created"
    }
    catch
    {
        Write-Warning "Error creating network account. Error: $($_.Exception.Message)"
        break
    }

新的Home Drive功能

Function New-BVUDrive
{
Param
(
    $Username,
    $Server
)

# Connect to the relevant server in CSV, create new folder, create new SMB Share for the user and add share/ NTFS permissions
    Invoke-Command -ComputerName $Server -ArgumentList $Username -ErrorAction Stop -ScriptBlock 
    {
        param($Username)  

        $FindShare = (Get-SmbShare -Name Users$).Path

        if($FindShare -eq $true)
        {

            try
            {
                New-Item -ItemType Directory -Path "$FindShare\$Username" -ErrorAction Stop
                New-SmbShare -Name "$Username$" -Path "$FindShare\$Username" -FullAccess "AD\Server Admins", "AD\Domain Admins" -ChangeAccess "AD\$Username" -ErrorAction Stop

                $Acl = Get-Acl "$FindShare\$Username"

                foreach($Rule in $Acl.Access) 
                {        
                    $Acl.RemoveAccessRule($Rule)
                }

                $Ar = New-Object  system.security.accesscontrol.filesystemaccessrule("Everyone","FullControl","Allow") 
                $Acl.SetAccessRule($Ar)

                $Acl.SetAccessRuleProtection($false, $true)

                Set-Acl "$FindShare\$Username" $Acl -ErrorAction Stop
            }
            catch
            {
                Write-Warning "U drive failed to create. Error: $($_.Exception.Message)"
            }
        }
        else
        {
            Write-Warning "Users$ share not found on server"
        }
    }
}

Answer 1

您是否尝试过使用SID？在第二个功能New-BVUDrive中，将用户名替换为SID。并使用以下cmdlet获取SID：

(Get-ADUser -Identity $SamAccountName).SID.Value

您现在就可以设置ACL，直到复制数据为止，您将在安全选项卡中看到SID，但是如果尝试，则用户将能够访问该文件夹。

$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule ($SIDIdentity, 'FullControl', ('ContainerInherit','ObjectInherit'), 'None','Allow')

希望这会有所帮助。

Powershell-新用户主文件夹权限

1 个答案: