PowerShell文件夹权限错误 - 无法转换部分或全部身份引用.

Question

我已经阅读了很多关于此的帖子,但我仍然无法得到它.我正在运行此脚本作为管理员,它确实创建了所需的文件夹,只是没有设置适当的权限.任何帮助,将不胜感激.谢谢!

$Users = Get-Content "D:\New_Users.txt"
ForEach ($user in $users)
{
    $newPath = Join-Path "F:\Users" -childpath $user
    New-Item $newPath -type directory

    $UserObj = New-Object System.Security.Principal.NTAccount("DOMAIN",$user)

    $acl = Get-Acl $newpath
    $acl.SetAccessRuleProtection($True, $False)
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("O1OAK\$user","AppendData,CreateDirectories,CreateFiles,DeleteSubdirectoriesAndFiles,ExecuteFile,ListDirectory,Modify,Read,ReadAndExecute,ReadAttributes,ReadData,ReadExtendedAttributes,ReadPermissions,Synchronize,Traverse,Write,WriteAttributes,WriteData,WriteExtendedAttributes","ContainerInherit, ObjectInherit","None","Allow")
    $acl.SetAccessRule($accessRule)
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","FullControl","ContainerInherit, ObjectInherit","None","Allow")
    $acl.SetAccessRule($accessRule)
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit, ObjectInherit","None","Allow")
    $acl.SetAccessRule($accessRule)
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("1OAK\$user","Delete","ContainerInherit, ObjectInherit","None","Allow")
    $acl.removeAccessRule($accessRule)
    $acl.SetOwner($UserObj)
    $acl | Set-Acl $newpath
}

我得到的3个字符串中的第一个错误如下.我认为这是最重要的,并将修复其他2.

Exception calling "SetAccessRule" with "1" argument(s): "Some or all identity references could not be translated."
At D:\DOMAIN\IT\IT Private\User Drives\user_folders.ps1:12 char:20
+     $acl.SetAccessRule <<<< ($accessRule)
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException

我希望这不是重复的,我很抱歉,如果是的话,我已经读了几个小时.谢谢!

Answer 1

错误很简单: Some or all identity references could not be translated.

这意味着无法找到该帐户.所以你要做的就是验证你的账户.由于您要添加4个ACE,因此您需要确定哪个无效.

最简单的方法是使用ISE或PowerGUI逐行调试.

我用"NT AUTHORITY\SYSTEM"和"BUILTIN\Administrators"尝试了你的代码,它的工作原理是问题是"O1OAK\$user"或"1OAK\$user".您的文本文件中可能包含无效帐户.