Question

有一个脚本可以提取我服务器上网络共享中所有文件夹的ACL（减去管理员共享）。似乎可以正常工作，但输出显示的是我一些数字而不是权限，而且我不明白数字的含义，更好的是如何将其转换为常规权限（FC，RO等）

$shares = Get-SmbShare | Where-Object Name -notlike "*$" | Select-Object Name

$Report = @()
foreach ($share in $shares){
   $path = "\\$env:COMPUTERNAME\" + $share.Name.ToString()
   $FolderPath = dir -Directory -Path $path -Recurse -Force
   Foreach ($Folder in $FolderPath) {
      $Acl = Get-Acl -Path $Folder.FullName
      foreach ($Access in $acl.Access)
      {
         $Properties = [ordered]@{
            'FolderName'=$Folder.FullName;
            'ADGroup or User'=$Access.IdentityReference;
            'Permissions'=$Access.FileSystemRights;
            'Inherited'=$Access.IsInherited}
         $Report += New-Object -TypeName PSObject -Property $Properties
      }
   }
}
$Report | Export-Csv -path "C:\temp\FolderPermissions.csv"

这是我得到的一些输出（将其简短一些以使其简短）

"FolderName","ADGroup or User","Permissions","Inherited"
"\\WIN-RPK9O6GR3JM\foobar\STE","NT AUTHORITY\SYSTEM","FullControl","True"
...
"\\WIN-RPK9O6GR3JM\foobar\STE","CREATOR OWNER","268435456","True"
"\\WIN-RPK9O6GR3JM\foobar\STE\LOG","BUILTIN\Users","CreateFiles","True"
"\\WIN-RPK9O6GR3JM\foobar\STE\LOG","CREATOR OWNER","268435456","True"
...
"\\WIN-RPK9O6GR3JM\foobar\STE\TMP","BUILTIN\Users","CreateFiles","True"
"\\WIN-RPK9O6GR3JM\foobar\STE\TMP","CREATOR OWNER","268435456","True"
...
"\\WIN-RPK9O6GR3JM\SYSVOL\foobar.net","NT AUTHORITY\Authenticated Users","-1610612736","True"
...
"\\WIN-RPK9O6GR3JM\SYSVOL\foobar.net","BUILTIN\Administrators","-536084480","True"

如果有人可以向我解释或指出这些价值观是什么以及如何翻译它们，我将不胜感激。

TIA！

Answer 1

到目前为止，我已经可以帮助您了：

268435456 - FullControl

-536805376 - Modify, Synchronize

-1610612736 - ReadAndExecute, Synchronize

但是请通过链接将它们联系起来：

Link 1

Link 2

Link 3

希望它对您有帮助。

获取共享中所有文件夹的ACL

1 个答案: