使用powershell删除文件夹上的所有ACL

Question

我是PowerShell脚本的新手(自从我开始学习powershell以来将近一个月).

我目前正在使用powershell 2.0编写一个脚本来清理文件夹NTFS ACL.我想删除除管理员之外的每个acl.

我的问题是我找不到删除每个非管理员的acl的方法,而不知道它们.

所以我来到这里寻求powershell pro.

Answer 1

此代码删除acl:

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$acl.Access | %{$acl.RemoveAccessRule($_)}

此代码添加管理员acl:

#BUILTIN administrator

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$permission  = "BUILTIN\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl \\remote_server\share_folder\HAL.9000 $acl

#Domain controller administrator

$acl = Get-Acl \\remote_server\share_folder\HAL.9000
$permission  = "DOMAINCONTROLLER\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl \\remote_server\share_folder\HAL.9000 $acl

希望这会帮助别人:)

Answer 2

为了方便起见，我将所有这些内容复制/粘贴到一个函数中。如果它可以对任何人有用，则为：

Function Remove-ACL {    
    [CmdletBinding(SupportsShouldProcess=$True)]
    Param(
        [parameter(Mandatory=$true,ValueFromPipeline=$true,Position=0)]
        [ValidateNotNullOrEmpty()]
        [ValidateScript({Test-Path $_ -PathType Container})]
        [String[]]$Folder,
        [Switch]$Recurse
    )

    Process {

        foreach ($f in $Folder) {

            if ($Recurse) {$Folders = $(Get-ChildItem $f -Recurse -Directory).FullName} else {$Folders = $f}

            if ($Folders -ne $null) {

                $Folders | ForEach-Object {

                    # Remove inheritance
                    $acl = Get-Acl $_
                    $acl.SetAccessRuleProtection($true,$true)
                    Set-Acl $_ $acl

                    # Remove ACL
                    $acl = Get-Acl $_
                    $acl.Access | %{$acl.RemoveAccessRule($_)} | Out-Null

                    # Add local admin
                    $permission  = "BUILTIN\Administrators","FullControl", "ContainerInherit,ObjectInherit","None","Allow"
                    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
                    $acl.SetAccessRule($rule)

                    Set-Acl $_ $acl

                    Write-Verbose "Remove-HCacl: Inheritance disabled and permissions removed from $_"
                }
            }
            else {
                Write-Verbose "Remove-HCacl: No subfolders found for $f"
            }
        }
    }
}

用法：

# For only one folder:
Remove-ACL 'C:\Folder' -Verbose

# For all subfolders:
Remove-ACL 'C:\Folder' -Recurse -Verbose

# Pipe stuff
'C:\Folder 1', 'C:\Folder 2' | Remove-ACL -Verbose