I've been poking around the web trying to put everything I think I understand together. Good resources out there, shout out to awesomeoman because I'm attempting to change a bit of his powershell to work for my needs.
For quick auditing purposes, I'm trying to figure folder permissions on specific directories. List users and groups. I got that far but now as I guessed, they also want the users in the groups. Here is what I have so far:
$Paths = Get-Content -Path "C:\Users\tango\Documents\listofdirectories.txt"
$Output = @()
foreach ($path in $paths)
{
write-host "Processing $path"
Get-ACL "$Path" | Format-List -Property Path
If ($? -eq $false)
{write-host "FOUND ERROR for $Path"}
Else
{
$ACLs = get-acl -path $path | select -expand access | where-object{$_.identityreference -notlike "*S-1-5-21-*"} | select IdentityReference,FileSystemRights
foreach ($ACL in $ACLs)
{
$strObject = ($ACL.IdentityReference).ToString().split("\")[1]
$objResults = New-Object System.Object
$ACLobjectType = get-aduser $strObject | select -expand objectclass
if($ACLobjectType -eq "user")
{
$user = get-aduser $strObject -Properties * | Select SamAccountName,Displayname
$objResults | Add-Member -MemberType NoteProperty -Name "Name" -Value$user.samaccountname
$objResults | Add-Member -MemberType NoteProperty -Name "Display
Name" -Value $user.displayname
$objResults | Add-Member -MemberType NoteProperty -Name "Type" -Value$ACLobjectType
$objResults | Add-Member -MemberType NoteProperty -Name "Permission" -Value $ACL.FileSystemRights
$objResults | Add-Member -MemberType NoteProperty -Name "Path" -Value$path
$Output += $objResults
}
if($ACLobjectType -eq "group")
{
$member = Get-ADGroup $strObject -Properties * | Select SamAccountName
$objResults | Add-Member -MemberType NoteProperty -Name "Name" -Value$member.samaccountname
$objResults | Add-Member -MemberType NoteProperty -Name "Group" -Value$member.displayname
$objResults | Add-Member -MemberType NoteProperty -Name "Type" -Value$ACLobjectType
$objResults | Add-Member -MemberType NoteProperty -Name "Permission" -Value $ACL.FileSystemRights
$objResults | Add-Member -MemberType NoteProperty -Name "Path" -Value$path
$Output += $objResults
}
}
}
}
$output | export-csv .\list.csv -notype
My question is why is my if statement $ACLobjectType -eq "user"
still listing groups as a user when I run this? And when does this it lists the previous user and the name and displayname. Total beginner at this, so any help would be appreciated.
