# Корень
$folder = "C:\Обмен"
$gsr = @()
$grw = @()
# Получим все районы
$r = Get-ADOrganizationalUnit -Filter * -SearchBase "ou=main,dc=fire37,dc=ru" -SearchScope OneLevel
# Создадим районы
$r | Foreach {
$f = Join-Path $folder $_.Name
if(!(Test-Path $f)) {
md $f | Out-Null
}
}
# Создадим службы
$grs = $r | Foreach {
$n = $_.Name
Get-ADOrganizationalUnit -Filter * -SearchBase $_.DistinguishedName -SearchScope OneLevel | Foreach {
$f = Join-Path $folder "$n\$($_.name)"
if(!(Test-Path $f)) {
md $f
}
}
}
# Создадим группы и добавим пользователей
$r | Foreach {
$n = $_.Name
# Получим службы в OU
Get-ADOrganizationalUnit -Filter * -SearchBase $_.DistinguishedName -SearchScope OneLevel | Foreach {
$users = Get-ADUser -Filter * -SearchBase $_.DistinguishedName
# Создадим группу RW_Отдел_Служба
$nw = "RW_$n`_$($_.name)"
$gw = New-ADGroup -Name $nw -GroupCategory Security -GroupScope Global -PassThru
Add-ADGroupMember -Identity $gw -Members $users
# Создадим группу RW_Отдел_Служба
$nr = "R_$n`_$($_.name)"
$gr = New-ADGroup -Name $nr -GroupCategory Security -GroupScope Global -PassThru
Add-ADGroupMember -Identity $gr -Members $users
$gsr += $gr.name
$grw += $gw.name
}
}
# Назначим права
$grs | Group Name | Foreach {
if($_.Count -gt 1) {
$_.Group | Foreach {
$gr = "RW_$($_.Parent.Name)_$($_.Name)"
$acl = Get-Acl $_.FullName
if($grw -eq $gr) {
$acl.SetAccessRuleProtection($true,$false)
$rule = New-Object Security.AccessControl.FileSystemAccessRule($gr,"Read,Write","ContainerInherit, ObjectInherit","None","Allow")
$acl.AddAccessRule($rule)
}
if($gsr -match "_$($_.Name)$") {
$gsr -match "_$($_.Name)$" -notmatch "R_$($_.Parent.Name)_" | Foreach {
$rule = New-Object Security.AccessControl.FileSystemAccessRule($_,"Read","ContainerInherit, ObjectInherit","None","Allow")
$acl.AddAccessRule($rule)
}
}
$acl | Set-Acl $_.FullName
}
}
else {
$f = $_.Group
$gr = "RW_$($f.Parent.Name)_$($f.Name)"
if($grw -eq $gr) {
$acl = Get-Acl $f.FullName
$acl.SetAccessRuleProtection($true,$false)
$rule = New-Object Security.AccessControl.FileSystemAccessRule($gr,"Read,Write","ContainerInherit, ObjectInherit","None","Allow")
$acl.AddAccessRule($rule)
$acl | Set-Acl $f.FullName
}
}
}
