PowerShell设置高级NTFS权限

Question

我正在尝试应用在Windows安全设置的"高级"选项卡中定义的NTFS权限.一个ACL $Rule用于This folder only,另一个用于Subfolders and files only.

权限经过大量修改,如下所示:

(Get-Acl 'L:\Test\Beez\RAPJOUR\Appels List\Correct').Access

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrators
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None

FileSystemRights  : CreateFiles, AppendData, DeleteSubdirectoriesAndFiles, ReadAndExecute, Synchronize
AccessControlType : Allow
IdentityReference : Domain\Dirk
IsInherited       : False
InheritanceFlags  : None
PropagationFlags  : None

FileSystemRights  : DeleteSubdirectoriesAndFiles, Modify, Synchronize
AccessControlType : Allow
IdentityReference : Domain\Dirk
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : InheritOnly

• 一切都在开启,除了:完全控制,写入属性,写入扩展属性,删除,更改权限和获取所有权.

• 一切都在开启,除了:完全控制,更改权限和获得所有权.

这是我用来应用权限的一段代码.在这种情况下,必须在部分中定义Change:

 $f = 'L:\Test\Beez\RAPJOUR\Appels List\Wrong'
 $ADobject = 'Domain\User'
 $acl = Get-Acl $f

 $Grant = 'Change'
    # Remove user/group first
    $rule = New-Object system.security.AccessControl.FileSystemAccessRule("$ADobject","Read",,,"Allow")
    $acl.RemoveAccessRuleAll($rule)

    # Add read permissions
    if ($Grant -eq 'ReadAndExecute') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject", "ReadAndExecute", "ContainerInherit, ObjectInherit", "None", "Allow")
    }

    if ($Grant -eq 'Change') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject", "Modify", "ContainerInherit, ObjectInherit", "Synchronize", "Allow  DeleteSubdirectoriesAndFiles")
        $acl.AddAccessRule($rule)
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject", "AppendData", "ContainerInherit, ObjectInherit", "ReadAndExecute","Synchronize", "Allow  CreateFiles","DeleteSubdirectoriesAndFiles")
    }

    if ($Grant -eq 'Modify') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject", "Modify", "ContainerInherit, ObjectInherit", "None", "Allow")
    }

    if ($Grant -eq 'FullControl') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject", "FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
    }

    if ($Grant -eq 'ListFolderContents') {
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject", "ReadAndExecute", "ContainerInherit", "None", "Allow")
    }

$acl.AddAccessRule($rule)
Set-Acl $f $acl

我似乎无法正确的语法..谢谢你的帮助.

感谢这篇文章,我已经找到了以下部分:

• '仅子文件夹和文件': "ContainerInherit, ObjectInherit", "InheritOnly"
• '仅此文件夹': "None", "InheritOnly"

Answer 1

Windows中的对象访问权限通过访问控制列表(ACL)控制, ACL基本上由访问控制条目(ACE)列表组成.每个ACE都是一组属性,用于控制是授予还是拒绝访问,ACE应用于谁,ACE是否从父对象继承,以及是否应由子对象继承.

如果您查看FileSystemAccessRule该类的文档,您将看到"完整"构造函数需要5个参数:

• IdentityReference/ String:标识ACE适用的受托者(用户,组,计算机......)的对象或字符串.
• FileSystemRights:要授予或拒绝的实际权限.
• InheritanceFlags:标志,用于控制哪些对象类型从此对象继承权限(容器,叶对象或无).
• PropagationFlags:用于控制权限传播的标志.该标志InheritOnly免除当前对象接收ACE.该标志NoPropagateInherit将继承限制为直接子对象.
• AccessControlType:ACE 的类型(允许或拒绝).

现在,如果要为给定的受托者分配多个访问权限,您可以使用单个ACE执行此操作:

$acl  = Get-Acl $path
$ace1 = New-Object Security.AccessControl.FileSystemAccessRule 'DOMAIN\user',
        'ListDirectory', 'ContainerInherit, ObjectInherit', 'InheritOnly',
        'Allow'
$acl.AddAccessRule($ace1)
$ace2 = New-Object Security.AccessControl.FileSystemAccessRule 'DOMAIN\user',
        'ReadAttributes', 'ContainerInherit, ObjectInherit', 'InheritOnly',
        'Allow'
$acl.AddAccessRule($ace2)
...

或者通过以逗号分隔的字符串提供权限:

$acl = Get-Acl $path
$ace = New-Object Security.AccessControl.FileSystemAccessRule 'DOMAIN\user',
       'ListDirectory, ReadAttributes, ...', 'ContainerInherit,  ObjectInherit',
       'InheritOnly', 'Allow'
$acl.AddAccessRule($ace)

但请注意,您无法使用相同的ACE授予和拒绝权限.如果要拒绝特定的访问权限,则需要使用单独的ACE执行此操作:

$acl  = Get-Acl $path
$ace1 = New-Object Security.AccessControl.FileSystemAccessRule 'DOMAIN\user',
        'Modify', 'ContainerInherit, ObjectInherit', 'InheritOnly',
        'Allow'
$acl.AddAccessRule($ace1)
$ace2 = New-Object Security.AccessControl.FileSystemAccessRule 'DOMAIN\user',
        'CreateDirectories', 'ContainerInherit, ObjectInherit', 'InheritOnly',
        'Deny'
$acl.AddAccessRule($ace2)
...

另请注意,显式权限优先于继承权限,并Deny优先于Allow.

Answer 2

当您与世界问题作斗争时，您知道情况如何。您发布问题的那一刻，您会在 5 分钟后找到答案...

感谢Frode F.在另一个问题上的回答，我找到了自己问题的解决方案。我不得不复制该行的输出FileSystemRights中$Correct.Access，并将其粘贴在Array你可以看到如下：

 $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject", @("CreateFiles", "AppendData", "DeleteSubdirectoriesAndFiles"," ReadAndExecute", "Synchronize"), "None", "InheritOnly", "Allow") # This folder only   
 $acl.AddAccessRule($rule)
 $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$ADobject", @("DeleteSubdirectoriesAndFiles", "Modify", "Synchronize"), "ContainerInherit, ObjectInherit", "InheritOnly", "Allow") # Subfolders and files only