696 lines
23 KiB
PowerShell
696 lines
23 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Creates a local LIAM NTFS demo fixture with folders and ACL groups from a production log.
|
|
|
|
.DESCRIPTION
|
|
This script recreates the BRE.01.LEW/Projekte folder and ACL-group fixture from
|
|
the diagnostic log in the local imagoverum.com demo environment:
|
|
|
|
- local folder: C:\file_shares\share2
|
|
- optional SMB share: \\<local-server>\file_shares\share2
|
|
- group strategy: Ntfs_AGDLP
|
|
- group tags: FS for global groups, UG for domain-local groups
|
|
- access tags: _O, _W, _R, _T
|
|
|
|
By default the script creates the exact folders visible in the log and creates
|
|
the logged ACL groups in the configured OU, then grants them Read permissions
|
|
on the matching local folders. Expected LIAM groups can be created separately
|
|
with -CreateExpectedLiamGroups.
|
|
|
|
Run with -WhatIf first. The ActiveDirectory module is only required when
|
|
AD group creation and ACL assignment are enabled.
|
|
#>
|
|
|
|
[CmdletBinding(SupportsShouldProcess = $true)]
|
|
param(
|
|
[string]$ShareRootPath = 'C:\file_shares',
|
|
|
|
[string]$RootFolderName = 'share2',
|
|
|
|
[string]$SmbShareName = 'file_shares',
|
|
|
|
[string]$GroupOuDN = 'OU=AGP,OU=LIAM,OU=Global,DC=imagoverum,DC=com',
|
|
|
|
[string[]]$AdditionalFolderRelativePaths = @(),
|
|
|
|
[string]$GroupNameSanitizeReplacement = '_',
|
|
|
|
[switch]$PreserveAdGroupNameCase,
|
|
|
|
[switch]$CreateExpectedLiamGroups,
|
|
|
|
[switch]$SkipLogAclFixture,
|
|
|
|
[switch]$SkipAdGroups,
|
|
|
|
[switch]$SkipNtfsAcl,
|
|
|
|
[switch]$SkipSmbShare
|
|
)
|
|
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
if ([System.Environment]::OSVersion.Platform -ne [System.PlatformID]::Win32NT) {
|
|
throw 'Dieses Script kann nur unter Windows ausgefuehrt werden.'
|
|
}
|
|
|
|
$rootPath = Join-Path -Path $ShareRootPath -ChildPath $RootFolderName
|
|
$readRights = [System.Security.AccessControl.FileSystemRights]0x200A9
|
|
$writeRights = [System.Security.AccessControl.FileSystemRights]0x301BF
|
|
$ownerRights = [System.Security.AccessControl.FileSystemRights]0x1F01FF
|
|
|
|
$logFolderRelativePaths = @(
|
|
'Arbeitsgruppen',
|
|
'Quartalsplanungen',
|
|
'Projekte',
|
|
'Projekte\__Templ',
|
|
'Projekte\_BAMS_AD Projekte',
|
|
'Projekte\__Admin Only',
|
|
'Projekte\_LSMS_AD Projekte',
|
|
'Projekte\_SW Projekte',
|
|
'Projekte\_AD Projekte',
|
|
'Projekte\_Templ_BMID',
|
|
'Projekte\_HW Projekte',
|
|
'Projekte\_IVD_Projekte',
|
|
'ProjekteAbgeschlossen',
|
|
'RESTORE',
|
|
'Design Control Harmonization',
|
|
'PMO'
|
|
)
|
|
|
|
$logAclFixtures = @(
|
|
@{
|
|
RelativePath = ''
|
|
Groups = @(
|
|
'UG_BRE.BDAL.DE.Users',
|
|
'DALDE-gArchimedesLEW_ALL_RO',
|
|
'DALDE-gArchimedesLEW_Admins',
|
|
'DALDE-gArchimedesLEW_Projekte_Browse',
|
|
'UG_BRE.01',
|
|
'FS_BRE.01.Archimedes_LEW-RW',
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte'
|
|
Groups = @(
|
|
'UG_BRE.BDAL.DE.Users',
|
|
'DALDE-gArchimedesLEW_AccessGroup_PAW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_SVC',
|
|
'DALDE-gArchimedesLEW_AccessGroup_TER',
|
|
'DALDE-gArchimedesLEW_ALL_RO',
|
|
'DALDE-gArchimedesLEW_Admins',
|
|
'DALDE-gArchimedesLEW_AccessGroup_PRM',
|
|
'DALDE-gArchimedesLEW_AccessGroup_QS',
|
|
'DALDE-gArchimedesLEW_AccessGroup_WB',
|
|
'DALDE-gArchimedesLEW_RO_Leipzig',
|
|
'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EEL',
|
|
'DALDE-gArchimedesLEW_AccessGroup_TPS',
|
|
'DALDE-gArchimedesLEW_RW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_KST',
|
|
'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
|
|
'DALDE-_Autocad',
|
|
'DALDE-gArchimedesLEW_AccessGroup_APP',
|
|
'DALDE-gArchimedesLEW_Projekte_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EPT',
|
|
'DALDE-gArchimedesLEW_Projekte_Browse',
|
|
'UG_BRE.01',
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\__Templ'
|
|
Groups = @(
|
|
'UG_BRE.BDAL.DE.Users',
|
|
'DALDE-gArchimedesLEW_Projekte_Browse',
|
|
'UG_BRE.01',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_APP',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_GL',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_EEl',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_EpT',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_ESw',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_G&L',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_KSt',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_PRM',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_QS',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_Svc',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_TeR',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_TPS',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_RA_LSMS',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_Proc',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_BD',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_Mark',
|
|
'FG_BRE.01.ArchimedesLEW_AccessGroup_Fin',
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\_BAMS_AD Projekte'
|
|
Groups = @(
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\__Admin Only'
|
|
Groups = @(
|
|
'DALDE-gArchimedesLEW_Admins',
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\_LSMS_AD Projekte'
|
|
Groups = @(
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\_SW Projekte'
|
|
Groups = @(
|
|
'DALDE-gArchimedesLEW_AccessGroup_PAW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_SVC',
|
|
'DALDE-gArchimedesLEW_SWProjekte_RW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_TER',
|
|
'DALDE-gArchimedesLEW_ManagerSW_RW',
|
|
'DALDE-gArchimedesLEW_Admins',
|
|
'DALDE-gArchimedesLEW_AccessGroup_PRM',
|
|
'DALDE-gArchimedesLEW_AccessGroup_QS',
|
|
'DALDE-gArchimedesLEW_AccessGroup_WB',
|
|
'DALDE-gArchimedesLEW_SWProjekte_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EEL',
|
|
'DALDE-gArchimedesLEW_AccessGroup_TPS',
|
|
'DALDE-gArchimedesLEW_AccessGroup_KST',
|
|
'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
|
|
'DALDE-gArchimedesLEW_AccessGroup_APP',
|
|
'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EPT',
|
|
'DALDE-gArchimedesLEW_Projekte_Browse',
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\_AD Projekte'
|
|
Groups = @(
|
|
'UG_BRE.BDAL.DE.Users',
|
|
'DALDE-gArchimedesLEW_AccessGroup_PAW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_SVC',
|
|
'DALDE-gArchimedesLEW_AccessGroup_TER',
|
|
'DALDE-gArchimedesLEW_ALL_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_PRM',
|
|
'DALDE-gArchimedesLEW_AccessGroup_QS',
|
|
'DALDE-gArchimedesLEW_AccessGroup_WB',
|
|
'DALDE-gArchimedesLEW_RO_Leipzig',
|
|
'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EEL',
|
|
'DALDE-gArchimedesLEW_AccessGroup_TPS',
|
|
'DALDE-gArchimedesLEW_RW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_KST',
|
|
'DALDE-gArchimedesLEW_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
|
|
'DALDE-_Autocad',
|
|
'DALDE-gArchimedesLEW_AccessGroup_APP',
|
|
'DALDE-gArchimedesLEW_Projekte_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EPT',
|
|
'DALDE-gArchimedesLEW_Projekte_Browse',
|
|
'UG_BRE.01',
|
|
'FS_BRE.01.Archimedes_LEW_Projekte_AD Projekte RW',
|
|
'FS_BRE.01.Archimedes_LEW_Projekte_AD Projekte RO',
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\_Templ_BMID'
|
|
Groups = @(
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\_HW Projekte'
|
|
Groups = @(
|
|
'DALDE-gArchimedesLEW_AccessGroup_PAW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_SVC',
|
|
'DALDE-gArchimedesLEW_AccessGroup_FSt',
|
|
'DALDE-gArchimedesLEW_ManagerHW_RW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_GL',
|
|
'DALDE-gArchimedesLEW_AccessGroup_TER',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EBIO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_PRM',
|
|
'DALDE-gArchimedesLEW_HWProjekt_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_QS',
|
|
'DALDE-gArchimedesLEW_AccessGroup_WB',
|
|
'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
|
|
'DALDE-gArchimedesLEW_HWProjekt_RFAP1_RO',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EEL',
|
|
'DALDE-gArchimedesLEW_AccessGroup_TPS',
|
|
'DALDE-gArchimedesLEW_AccessGroup_KST',
|
|
'DALDE-gArchimedesLEW_AccessGroup_APP',
|
|
'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
|
|
'DALDE-gArchimedesLEW_AccessGroup_EPT',
|
|
'DALDE-gArchimedesLEW_Projekte_Browse',
|
|
'UG_BRE.01.ArchimedesLEW_Projekte_HW Projekte RW',
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
},
|
|
@{
|
|
RelativePath = 'Projekte\_IVD_Projekte'
|
|
Groups = @(
|
|
'DALDE-gArchimedesLEW_IVD_Projekte_RW',
|
|
'FS_BRE.01.ArchimedesLEW_Projekte_IVD Projekte RW',
|
|
'FS_BRE.01.ArchimedesLEW_Projekte_IVD Projekte RO',
|
|
'AG_ETT.01.File Server Administrators_Restricted'
|
|
)
|
|
}
|
|
)
|
|
|
|
function ConvertTo-LiamSafeNameSegment {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Value,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Replacement,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[bool]$PreserveCase
|
|
)
|
|
|
|
$safeReplacement = if ($null -eq $Replacement) { '_' } else { $Replacement.Trim() }
|
|
if ($safeReplacement -in @('<empty>', 'empty', 'none', 'remove')) {
|
|
$safeReplacement = ''
|
|
}
|
|
if ([string]::IsNullOrWhiteSpace($safeReplacement) -and $Replacement -notin @('<empty>', 'empty', 'none', 'remove')) {
|
|
$safeReplacement = '_'
|
|
}
|
|
|
|
$safeValue = [regex]::Replace($Value, '[\x00-\x1F\x7F/\\\[\]:;\|=,\+\*\?<>]', $safeReplacement)
|
|
if ($PreserveCase) {
|
|
return $safeValue
|
|
}
|
|
|
|
return $safeValue.ToUpperInvariant()
|
|
}
|
|
|
|
function Get-LiamFolderToken {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$FolderPath
|
|
)
|
|
|
|
$itemName = Split-Path -Path $FolderPath -Leaf
|
|
if ([string]::IsNullOrWhiteSpace($itemName)) {
|
|
$itemName = $RootFolderName
|
|
}
|
|
|
|
ConvertTo-LiamSafeNameSegment `
|
|
-Value $itemName `
|
|
-Replacement $GroupNameSanitizeReplacement `
|
|
-PreserveCase $PreserveAdGroupNameCase.IsPresent
|
|
}
|
|
|
|
function Get-LiamGroupSet {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$FolderPath
|
|
)
|
|
|
|
$name = Get-LiamFolderToken -FolderPath $FolderPath
|
|
|
|
[pscustomobject]@{
|
|
FolderPath = $FolderPath
|
|
Name = $name
|
|
GlobalOwner = "FS_${name}_O"
|
|
GlobalWrite = "FS_${name}_W"
|
|
GlobalRead = "FS_${name}_R"
|
|
GlobalTraverse = "FS_${name}_T"
|
|
LocalOwner = "UG_${name}_O"
|
|
LocalWrite = "UG_${name}_W"
|
|
LocalRead = "UG_${name}_R"
|
|
}
|
|
}
|
|
|
|
function Ensure-Folder {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Path
|
|
)
|
|
|
|
if (Test-Path -LiteralPath $Path) {
|
|
return
|
|
}
|
|
|
|
if ($PSCmdlet.ShouldProcess($Path, 'Create directory')) {
|
|
New-Item -ItemType Directory -Path $Path -Force | Out-Null
|
|
}
|
|
}
|
|
|
|
function Ensure-SmbShare {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Name,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Path
|
|
)
|
|
|
|
$existingShare = Get-SmbShare -Name $Name -ErrorAction SilentlyContinue
|
|
if ($existingShare) {
|
|
if ($existingShare.Path -ne $Path) {
|
|
Write-Warning "SMB share '$Name' already points to '$($existingShare.Path)', not '$Path'."
|
|
}
|
|
return
|
|
}
|
|
|
|
if ($PSCmdlet.ShouldProcess($Name, "Create SMB share for '$Path'")) {
|
|
New-SmbShare -Name $Name -Path $Path -ChangeAccess 'Authenticated Users' | Out-Null
|
|
}
|
|
}
|
|
|
|
function ConvertTo-LdapFilterEscapedValue {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Value
|
|
)
|
|
|
|
$escapedValue = $Value.Replace('\', '\5c')
|
|
$escapedValue = $escapedValue.Replace('*', '\2a')
|
|
$escapedValue = $escapedValue.Replace('(', '\28')
|
|
$escapedValue = $escapedValue.Replace(')', '\29')
|
|
$escapedValue = $escapedValue.Replace([string][char]0, '\00')
|
|
|
|
return $escapedValue
|
|
}
|
|
|
|
function Get-AdGroupBySamAccountName {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$SamAccountName,
|
|
|
|
[string[]]$Properties = @()
|
|
)
|
|
|
|
$escapedSamAccountName = ConvertTo-LdapFilterEscapedValue -Value $SamAccountName
|
|
$parameters = @{
|
|
LDAPFilter = "(sAMAccountName=$escapedSamAccountName)"
|
|
ErrorAction = 'Stop'
|
|
}
|
|
|
|
if ($Properties.Count -gt 0) {
|
|
$parameters['Properties'] = $Properties
|
|
}
|
|
|
|
try {
|
|
return Get-ADGroup @parameters | Select-Object -First 1
|
|
}
|
|
catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] {
|
|
return $null
|
|
}
|
|
}
|
|
|
|
function Ensure-AdGroup {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Name,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateSet('Global', 'DomainLocal')]
|
|
[string]$Scope,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Description
|
|
)
|
|
|
|
$existingGroup = Get-AdGroupBySamAccountName -SamAccountName $Name
|
|
if ($existingGroup) {
|
|
return $existingGroup
|
|
}
|
|
|
|
if ($PSCmdlet.ShouldProcess($Name, "Create AD group in '$GroupOuDN'")) {
|
|
New-ADGroup `
|
|
-Name $Name `
|
|
-SamAccountName $Name `
|
|
-GroupCategory Security `
|
|
-GroupScope $Scope `
|
|
-Path $GroupOuDN `
|
|
-Description $Description | Out-Null
|
|
}
|
|
|
|
return Get-AdGroupBySamAccountName -SamAccountName $Name
|
|
}
|
|
|
|
function Ensure-AdGroupMembership {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$ParentGroup,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$MemberGroup
|
|
)
|
|
|
|
$parent = Get-AdGroupBySamAccountName -SamAccountName $ParentGroup -Properties @('member')
|
|
$member = Get-AdGroupBySamAccountName -SamAccountName $MemberGroup
|
|
if (-not $parent -or -not $member) {
|
|
if ($WhatIfPreference) {
|
|
if ($PSCmdlet.ShouldProcess($ParentGroup, "Add member group '$MemberGroup'")) {
|
|
}
|
|
return
|
|
}
|
|
|
|
throw "Cannot add '$MemberGroup' to '$ParentGroup' because at least one group does not exist."
|
|
}
|
|
|
|
if ($parent.member -contains $member.DistinguishedName) {
|
|
return
|
|
}
|
|
|
|
if ($PSCmdlet.ShouldProcess($ParentGroup, "Add member group '$MemberGroup'")) {
|
|
Add-ADGroupMember -Identity $parent -Members $member
|
|
}
|
|
}
|
|
|
|
function Ensure-LiamGroups {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[pscustomobject]$GroupSet
|
|
)
|
|
|
|
$groups = @(
|
|
@{ Name = $GroupSet.GlobalOwner; Scope = 'Global'; Description = "$($GroupSet.Name) - _O" }
|
|
@{ Name = $GroupSet.GlobalWrite; Scope = 'Global'; Description = "$($GroupSet.Name) - _W" }
|
|
@{ Name = $GroupSet.GlobalRead; Scope = 'Global'; Description = "$($GroupSet.Name) - _R" }
|
|
@{ Name = $GroupSet.LocalOwner; Scope = 'DomainLocal'; Description = "$($GroupSet.Name) - _O" }
|
|
@{ Name = $GroupSet.LocalWrite; Scope = 'DomainLocal'; Description = "$($GroupSet.Name) - _W" }
|
|
@{ Name = $GroupSet.LocalRead; Scope = 'DomainLocal'; Description = "$($GroupSet.Name) - _R" }
|
|
@{ Name = $GroupSet.GlobalTraverse; Scope = 'Global'; Description = "$($GroupSet.Name) - _T" }
|
|
)
|
|
|
|
foreach ($group in $groups) {
|
|
Ensure-AdGroup -Name $group.Name -Scope $group.Scope -Description $group.Description | Out-Null
|
|
}
|
|
|
|
Ensure-AdGroupMembership -ParentGroup $GroupSet.LocalOwner -MemberGroup $GroupSet.GlobalOwner
|
|
Ensure-AdGroupMembership -ParentGroup $GroupSet.LocalWrite -MemberGroup $GroupSet.GlobalWrite
|
|
Ensure-AdGroupMembership -ParentGroup $GroupSet.LocalRead -MemberGroup $GroupSet.GlobalRead
|
|
}
|
|
|
|
function Ensure-LogAclFixtureGroups {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[object[]]$Fixtures
|
|
)
|
|
|
|
$groupNames = $Fixtures |
|
|
ForEach-Object { $_['Groups'] } |
|
|
Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
|
|
Sort-Object -Unique
|
|
|
|
foreach ($groupName in $groupNames) {
|
|
$groupScope = if ($groupName -like 'UG_*') { 'DomainLocal' } else { 'Global' }
|
|
Ensure-AdGroup `
|
|
-Name $groupName `
|
|
-Scope $groupScope `
|
|
-Description 'Source ACL group from BRE.01.LEW diagnostic log' | Out-Null
|
|
}
|
|
}
|
|
|
|
function Add-FolderAccessRule {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Path,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$Account,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[System.Security.AccessControl.FileSystemRights]$Rights
|
|
)
|
|
|
|
if (-not (Test-Path -LiteralPath $Path)) {
|
|
if ($WhatIfPreference) {
|
|
if ($PSCmdlet.ShouldProcess($Path, "Add NTFS ACL '$Rights' for '$Account'")) {
|
|
}
|
|
return
|
|
}
|
|
|
|
throw "Path not found: $Path"
|
|
}
|
|
|
|
$acl = Get-Acl -LiteralPath $Path
|
|
$identity = [System.Security.Principal.NTAccount]::new($Account)
|
|
try {
|
|
$sid = $identity.Translate([System.Security.Principal.SecurityIdentifier])
|
|
}
|
|
catch [System.Security.Principal.IdentityNotMappedException] {
|
|
if ($WhatIfPreference) {
|
|
if ($PSCmdlet.ShouldProcess($Path, "Add NTFS ACL '$Rights' for '$Account'")) {
|
|
}
|
|
return
|
|
}
|
|
|
|
throw
|
|
}
|
|
|
|
foreach ($rule in $acl.Access) {
|
|
if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) {
|
|
continue
|
|
}
|
|
if ($rule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) {
|
|
continue
|
|
}
|
|
if (($rule.FileSystemRights -band $Rights) -eq $Rights) {
|
|
return
|
|
}
|
|
}
|
|
|
|
$accessRule = [System.Security.AccessControl.FileSystemAccessRule]::new(
|
|
$sid,
|
|
$Rights,
|
|
[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',
|
|
[System.Security.AccessControl.PropagationFlags]::None,
|
|
[System.Security.AccessControl.AccessControlType]::Allow
|
|
)
|
|
|
|
$acl.AddAccessRule($accessRule)
|
|
|
|
if ($PSCmdlet.ShouldProcess($Path, "Add NTFS ACL '$Rights' for '$Account'")) {
|
|
Set-Acl -LiteralPath $Path -AclObject $acl
|
|
}
|
|
}
|
|
|
|
function Ensure-LiamNtfsAcl {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[pscustomobject]$GroupSet,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$DomainNetBiosName
|
|
)
|
|
|
|
Add-FolderAccessRule -Path $GroupSet.FolderPath -Account "$DomainNetBiosName\$($GroupSet.LocalOwner)" -Rights $ownerRights
|
|
Add-FolderAccessRule -Path $GroupSet.FolderPath -Account "$DomainNetBiosName\$($GroupSet.LocalWrite)" -Rights $writeRights
|
|
Add-FolderAccessRule -Path $GroupSet.FolderPath -Account "$DomainNetBiosName\$($GroupSet.LocalRead)" -Rights $readRights
|
|
}
|
|
|
|
function Ensure-LogAclFixtureAcls {
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[object[]]$Fixtures,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$DomainNetBiosName
|
|
)
|
|
|
|
foreach ($fixture in $Fixtures) {
|
|
$relativePath = $fixture['RelativePath']
|
|
$folderPath = if ([string]::IsNullOrWhiteSpace($relativePath)) {
|
|
$rootPath
|
|
}
|
|
else {
|
|
Join-Path -Path $rootPath -ChildPath $relativePath
|
|
}
|
|
|
|
foreach ($groupName in ($fixture['Groups'] | Sort-Object -Unique)) {
|
|
Add-FolderAccessRule `
|
|
-Path $folderPath `
|
|
-Account "$DomainNetBiosName\$groupName" `
|
|
-Rights $readRights
|
|
}
|
|
}
|
|
}
|
|
|
|
$relativeFolders = @($logFolderRelativePaths + $AdditionalFolderRelativePaths) |
|
|
Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
|
|
ForEach-Object { $_.Trim().TrimStart('\', '/') } |
|
|
Sort-Object -Unique
|
|
|
|
Ensure-Folder -Path $ShareRootPath
|
|
Ensure-Folder -Path $rootPath
|
|
|
|
foreach ($relativeFolder in $relativeFolders) {
|
|
Ensure-Folder -Path (Join-Path -Path $rootPath -ChildPath $relativeFolder)
|
|
}
|
|
|
|
if (-not $SkipSmbShare) {
|
|
Ensure-SmbShare -Name $SmbShareName -Path $ShareRootPath
|
|
}
|
|
|
|
$foldersToManage = @($rootPath)
|
|
foreach ($relativeFolder in $relativeFolders) {
|
|
$foldersToManage += (Join-Path -Path $rootPath -ChildPath $relativeFolder)
|
|
}
|
|
|
|
$domainNetBiosName = $null
|
|
if (-not $SkipAdGroups -or -not $SkipNtfsAcl) {
|
|
Import-Module ActiveDirectory -ErrorAction Stop
|
|
$domainNetBiosName = (Get-ADDomain).NetBIOSName
|
|
}
|
|
|
|
if (-not $SkipAdGroups -and -not $SkipLogAclFixture) {
|
|
Ensure-LogAclFixtureGroups -Fixtures $logAclFixtures
|
|
}
|
|
|
|
$summary = foreach ($folder in $foldersToManage) {
|
|
$groupSet = Get-LiamGroupSet -FolderPath $folder
|
|
|
|
if (-not $SkipAdGroups -and $CreateExpectedLiamGroups) {
|
|
Ensure-LiamGroups -GroupSet $groupSet
|
|
}
|
|
|
|
if (-not $SkipNtfsAcl -and $CreateExpectedLiamGroups) {
|
|
Ensure-LiamNtfsAcl -GroupSet $groupSet -DomainNetBiosName $domainNetBiosName
|
|
}
|
|
|
|
$relativePath = if ($folder -eq $rootPath) {
|
|
''
|
|
}
|
|
else {
|
|
$folder.Substring($rootPath.Length).TrimStart('\')
|
|
}
|
|
$fixture = $logAclFixtures | Where-Object { $_['RelativePath'] -eq $relativePath } | Select-Object -First 1
|
|
|
|
[pscustomobject]@{
|
|
Folder = $folder
|
|
LogAclGroupCount = if ($fixture) { $fixture['Groups'].Count } else { 0 }
|
|
LocalOwnerAcl = $groupSet.LocalOwner
|
|
LocalWriteAcl = $groupSet.LocalWrite
|
|
LocalReadAcl = $groupSet.LocalRead
|
|
GlobalOwner = $groupSet.GlobalOwner
|
|
GlobalWrite = $groupSet.GlobalWrite
|
|
GlobalRead = $groupSet.GlobalRead
|
|
GlobalTraverse = $groupSet.GlobalTraverse
|
|
}
|
|
}
|
|
|
|
if (-not $SkipNtfsAcl -and -not $SkipLogAclFixture) {
|
|
Ensure-LogAclFixtureAcls -Fixtures $logAclFixtures -DomainNetBiosName $domainNetBiosName
|
|
}
|
|
|
|
$summary
|
|
|
|
Write-Host ''
|
|
Write-Host 'LIAM provider RootPath for this machine:'
|
|
Write-Host ("\\{0}\{1}\{2}" -f $env:COMPUTERNAME, $SmbShareName, $RootFolderName)
|