Recreate logged NTFS ACL fixture

Sonstiges/New-LiamNtfsDemoShareStructure.ps1

@@ -1,10 +1,10 @@
 <#
 .SYNOPSIS
-Creates a local LIAM NTFS demo share structure with AGDLP groups and ACLs.
+Creates a local LIAM NTFS demo fixture with folders and ACL groups from a production log.
 
 .DESCRIPTION
-This script mirrors the LIAM NTFS demo configuration for the imagoverum.com
-environment:
+This script recreates the BRE.01.LEW/Projekte folder and ACL-group fixture from
+the diagnostic log in the local imagoverum.com demo environment:
 
 - local folder: C:\file_shares\share2
 - optional SMB share: \\<local-server>\file_shares\share2
@@ -12,6 +12,11 @@ environment:
 - group tags: FS for global groups, UG for domain-local groups
 - access tags: _O, _W, _R, _T
 
+By default the script creates the exact folders visible in the log and creates
+the logged ACL groups in the configured OU, then grants them Read permissions
+on the matching local folders. Expected LIAM groups can be created separately
+with -CreateExpectedLiamGroups.
+
 Run with -WhatIf first. The ActiveDirectory module is only required when
 AD group creation and ACL assignment are enabled.
 #>
@@ -32,6 +37,10 @@ param(
 
     [switch]$PreserveAdGroupNameCase,
 
+    [switch]$CreateExpectedLiamGroups,
+
+    [switch]$SkipLogAclFixture,
+
     [switch]$SkipAdGroups,
 
     [switch]$SkipNtfsAcl,
@@ -51,6 +60,212 @@ $readRights = [System.Security.AccessControl.FileSystemRights]0x200A9
 $writeRights = [System.Security.AccessControl.FileSystemRights]0x301BF
 $ownerRights = [System.Security.AccessControl.FileSystemRights]0x1F01FF
 
+$logFolderRelativePaths = @(
+    'Arbeitsgruppen',
+    'Quartalsplanungen',
+    'Projekte',
+    'Projekte\__Templ',
+    'Projekte\_BAMS_AD Projekte',
+    'Projekte\__Admin Only',
+    'Projekte\_LSMS_AD Projekte',
+    'Projekte\_SW Projekte',
+    'Projekte\_AD Projekte',
+    'Projekte\_Templ_BMID',
+    'Projekte\_HW Projekte',
+    'Projekte\_IVD_Projekte',
+    'ProjekteAbgeschlossen',
+    'RESTORE',
+    'Design Control Harmonization',
+    'PMO'
+)
+
+$logAclFixtures = @(
+    @{
+        RelativePath = ''
+        Groups = @(
+            'UG_BRE.BDAL.DE.Users',
+            'DALDE-gArchimedesLEW_ALL_RO',
+            'DALDE-gArchimedesLEW_Admins',
+            'DALDE-gArchimedesLEW_Projekte_Browse',
+            'UG_BRE.01',
+            'FS_BRE.01.Archimedes_LEW-RW',
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte'
+        Groups = @(
+            'UG_BRE.BDAL.DE.Users',
+            'DALDE-gArchimedesLEW_AccessGroup_PAW',
+            'DALDE-gArchimedesLEW_AccessGroup_SVC',
+            'DALDE-gArchimedesLEW_AccessGroup_TER',
+            'DALDE-gArchimedesLEW_ALL_RO',
+            'DALDE-gArchimedesLEW_Admins',
+            'DALDE-gArchimedesLEW_AccessGroup_PRM',
+            'DALDE-gArchimedesLEW_AccessGroup_QS',
+            'DALDE-gArchimedesLEW_AccessGroup_WB',
+            'DALDE-gArchimedesLEW_RO_Leipzig',
+            'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_EEL',
+            'DALDE-gArchimedesLEW_AccessGroup_TPS',
+            'DALDE-gArchimedesLEW_RW',
+            'DALDE-gArchimedesLEW_AccessGroup_KST',
+            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
+            'DALDE-_Autocad',
+            'DALDE-gArchimedesLEW_AccessGroup_APP',
+            'DALDE-gArchimedesLEW_Projekte_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
+            'DALDE-gArchimedesLEW_AccessGroup_EPT',
+            'DALDE-gArchimedesLEW_Projekte_Browse',
+            'UG_BRE.01',
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\__Templ'
+        Groups = @(
+            'UG_BRE.BDAL.DE.Users',
+            'DALDE-gArchimedesLEW_Projekte_Browse',
+            'UG_BRE.01',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_APP',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_GL',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_EEl',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_EpT',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_ESw',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_G&L',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_KSt',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_PRM',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_QS',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_Svc',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_TeR',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_TPS',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_RA_LSMS',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_Proc',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_BD',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_Mark',
+            'FG_BRE.01.ArchimedesLEW_AccessGroup_Fin',
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\_BAMS_AD Projekte'
+        Groups = @(
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\__Admin Only'
+        Groups = @(
+            'DALDE-gArchimedesLEW_Admins',
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\_LSMS_AD Projekte'
+        Groups = @(
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\_SW Projekte'
+        Groups = @(
+            'DALDE-gArchimedesLEW_AccessGroup_PAW',
+            'DALDE-gArchimedesLEW_AccessGroup_SVC',
+            'DALDE-gArchimedesLEW_SWProjekte_RW',
+            'DALDE-gArchimedesLEW_AccessGroup_TER',
+            'DALDE-gArchimedesLEW_ManagerSW_RW',
+            'DALDE-gArchimedesLEW_Admins',
+            'DALDE-gArchimedesLEW_AccessGroup_PRM',
+            'DALDE-gArchimedesLEW_AccessGroup_QS',
+            'DALDE-gArchimedesLEW_AccessGroup_WB',
+            'DALDE-gArchimedesLEW_SWProjekte_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_EEL',
+            'DALDE-gArchimedesLEW_AccessGroup_TPS',
+            'DALDE-gArchimedesLEW_AccessGroup_KST',
+            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
+            'DALDE-gArchimedesLEW_AccessGroup_APP',
+            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
+            'DALDE-gArchimedesLEW_AccessGroup_EPT',
+            'DALDE-gArchimedesLEW_Projekte_Browse',
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\_AD Projekte'
+        Groups = @(
+            'UG_BRE.BDAL.DE.Users',
+            'DALDE-gArchimedesLEW_AccessGroup_PAW',
+            'DALDE-gArchimedesLEW_AccessGroup_SVC',
+            'DALDE-gArchimedesLEW_AccessGroup_TER',
+            'DALDE-gArchimedesLEW_ALL_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_PRM',
+            'DALDE-gArchimedesLEW_AccessGroup_QS',
+            'DALDE-gArchimedesLEW_AccessGroup_WB',
+            'DALDE-gArchimedesLEW_RO_Leipzig',
+            'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_EEL',
+            'DALDE-gArchimedesLEW_AccessGroup_TPS',
+            'DALDE-gArchimedesLEW_RW',
+            'DALDE-gArchimedesLEW_AccessGroup_KST',
+            'DALDE-gArchimedesLEW_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
+            'DALDE-_Autocad',
+            'DALDE-gArchimedesLEW_AccessGroup_APP',
+            'DALDE-gArchimedesLEW_Projekte_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
+            'DALDE-gArchimedesLEW_AccessGroup_EPT',
+            'DALDE-gArchimedesLEW_Projekte_Browse',
+            'UG_BRE.01',
+            'FS_BRE.01.Archimedes_LEW_Projekte_AD Projekte RW',
+            'FS_BRE.01.Archimedes_LEW_Projekte_AD Projekte RO',
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\_Templ_BMID'
+        Groups = @(
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\_HW Projekte'
+        Groups = @(
+            'DALDE-gArchimedesLEW_AccessGroup_PAW',
+            'DALDE-gArchimedesLEW_AccessGroup_SVC',
+            'DALDE-gArchimedesLEW_AccessGroup_FSt',
+            'DALDE-gArchimedesLEW_ManagerHW_RW',
+            'DALDE-gArchimedesLEW_AccessGroup_GL',
+            'DALDE-gArchimedesLEW_AccessGroup_TER',
+            'DALDE-gArchimedesLEW_AccessGroup_EBIO',
+            'DALDE-gArchimedesLEW_AccessGroup_PRM',
+            'DALDE-gArchimedesLEW_HWProjekt_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_QS',
+            'DALDE-gArchimedesLEW_AccessGroup_WB',
+            'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
+            'DALDE-gArchimedesLEW_HWProjekt_RFAP1_RO',
+            'DALDE-gArchimedesLEW_AccessGroup_EEL',
+            'DALDE-gArchimedesLEW_AccessGroup_TPS',
+            'DALDE-gArchimedesLEW_AccessGroup_KST',
+            'DALDE-gArchimedesLEW_AccessGroup_APP',
+            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
+            'DALDE-gArchimedesLEW_AccessGroup_EPT',
+            'DALDE-gArchimedesLEW_Projekte_Browse',
+            'UG_BRE.01.ArchimedesLEW_Projekte_HW Projekte RW',
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    },
+    @{
+        RelativePath = 'Projekte\_IVD_Projekte'
+        Groups = @(
+            'DALDE-gArchimedesLEW_IVD_Projekte_RW',
+            'FS_BRE.01.ArchimedesLEW_Projekte_IVD Projekte RW',
+            'FS_BRE.01.ArchimedesLEW_Projekte_IVD Projekte RO',
+            'AG_ETT.01.File Server Administrators_Restricted'
+        )
+    }
+)
+
 function ConvertTo-LiamSafeNameSegment {
     param(
         [Parameter(Mandatory = $true)]
@@ -240,6 +455,26 @@ function Ensure-LiamGroups {
     Ensure-AdGroupMembership -ParentGroup $GroupSet.LocalRead -MemberGroup $GroupSet.GlobalRead
 }
 
+function Ensure-LogAclFixtureGroups {
+    param(
+        [Parameter(Mandatory = $true)]
+        [object[]]$Fixtures
+    )
+
+    $groupNames = $Fixtures |
+        ForEach-Object { $_['Groups'] } |
+        Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+        Sort-Object -Unique
+
+    foreach ($groupName in $groupNames) {
+        $groupScope = if ($groupName -like 'UG_*') { 'DomainLocal' } else { 'Global' }
+        Ensure-AdGroup `
+            -Name $groupName `
+            -Scope $groupScope `
+            -Description 'Source ACL group from BRE.01.LEW diagnostic log' | Out-Null
+    }
+}
+
 function Add-FolderAccessRule {
     param(
         [Parameter(Mandatory = $true)]
@@ -318,7 +553,34 @@ function Ensure-LiamNtfsAcl {
     Add-FolderAccessRule -Path $GroupSet.FolderPath -Account "$DomainNetBiosName\$($GroupSet.LocalRead)" -Rights $readRights
 }
 
-$relativeFolders = @($AdditionalFolderRelativePaths) |
+function Ensure-LogAclFixtureAcls {
+    param(
+        [Parameter(Mandatory = $true)]
+        [object[]]$Fixtures,
+
+        [Parameter(Mandatory = $true)]
+        [string]$DomainNetBiosName
+    )
+
+    foreach ($fixture in $Fixtures) {
+        $relativePath = $fixture['RelativePath']
+        $folderPath = if ([string]::IsNullOrWhiteSpace($relativePath)) {
+            $rootPath
+        }
+        else {
+            Join-Path -Path $rootPath -ChildPath $relativePath
+        }
+
+        foreach ($groupName in ($fixture['Groups'] | Sort-Object -Unique)) {
+            Add-FolderAccessRule `
+                -Path $folderPath `
+                -Account "$DomainNetBiosName\$groupName" `
+                -Rights $readRights
+        }
+    }
+}
+
+$relativeFolders = @($logFolderRelativePaths + $AdditionalFolderRelativePaths) |
     Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
     ForEach-Object { $_.Trim().TrimStart('\', '/') } |
     Sort-Object -Unique
@@ -345,27 +607,44 @@ if (-not $SkipAdGroups -or -not $SkipNtfsAcl) {
     $domainNetBiosName = (Get-ADDomain).NetBIOSName
 }
 
+if (-not $SkipAdGroups -and -not $SkipLogAclFixture) {
+    Ensure-LogAclFixtureGroups -Fixtures $logAclFixtures
+}
+
 $summary = foreach ($folder in $foldersToManage) {
     $groupSet = Get-LiamGroupSet -FolderPath $folder
 
-    if (-not $SkipAdGroups) {
+    if (-not $SkipAdGroups -and $CreateExpectedLiamGroups) {
         Ensure-LiamGroups -GroupSet $groupSet
     }
 
-    if (-not $SkipNtfsAcl) {
+    if (-not $SkipNtfsAcl -and $CreateExpectedLiamGroups) {
         Ensure-LiamNtfsAcl -GroupSet $groupSet -DomainNetBiosName $domainNetBiosName
     }
 
-    [pscustomobject]@{
-        Folder         = $folder
-        LocalOwnerAcl  = $groupSet.LocalOwner
-        LocalWriteAcl  = $groupSet.LocalWrite
-        LocalReadAcl   = $groupSet.LocalRead
-        GlobalOwner    = $groupSet.GlobalOwner
-        GlobalWrite    = $groupSet.GlobalWrite
-        GlobalRead     = $groupSet.GlobalRead
-        GlobalTraverse = $groupSet.GlobalTraverse
+    $relativePath = if ($folder -eq $rootPath) {
+        ''
     }
+    else {
+        $folder.Substring($rootPath.Length).TrimStart('\')
+    }
+    $fixture = $logAclFixtures | Where-Object { $_['RelativePath'] -eq $relativePath } | Select-Object -First 1
+
+    [pscustomobject]@{
+        Folder             = $folder
+        LogAclGroupCount   = if ($fixture) { $fixture['Groups'].Count } else { 0 }
+        LocalOwnerAcl      = $groupSet.LocalOwner
+        LocalWriteAcl      = $groupSet.LocalWrite
+        LocalReadAcl       = $groupSet.LocalRead
+        GlobalOwner        = $groupSet.GlobalOwner
+        GlobalWrite        = $groupSet.GlobalWrite
+        GlobalRead         = $groupSet.GlobalRead
+        GlobalTraverse     = $groupSet.GlobalTraverse
+    }
+}
+
+if (-not $SkipNtfsAcl -and -not $SkipLogAclFixture) {
+    Ensure-LogAclFixtureAcls -Fixtures $logAclFixtures -DomainNetBiosName $domainNetBiosName
 }
 
 $summary