Quantcast
Channel: PowerShell.com – PowerShell Scripts, Tips, Forums, and Resources: Active Threads
Viewing all articles
Browse latest Browse all 8411

Set-ACL problem passing a string instead of an object variable...

$
0
0

Hi,

I have a problem that's giving me a head-ache but hopefully is simple to someone out there with a bigger brain than mine.

Basically I have script for new user creation that picks up a variable $logonname which is a text string the first initial and whole last name of the user being created, thus for the new user John Smith, the $logonname is JSmith. As the variable name suggests this is the Windows logon name for the user.

All this works fine, but later in the script I try to create the user's home and profile folders and assign permissions, as below:

 

$profilepath = "\\domain.com\profiles\$logonname"

$profilepathV2 = "\\domain.com\profiles\$logonname.V2"

$homepath = "\\domain.com\home\$logonname"

 

 

New-Item -type directory -Path $profilepath

New-Item -type directory -Path $profilepathv2

New-Item -type directory -Path $homepath


$Acl = Get-Acl $profilepath 

$Ar = New-Object system.security.accesscontrol.filesystemaccessrule("$logonname","FullControl","ContainerInherit, ObjectInherit", "None", "Allow") 

$Acl.AddAccessRule($Ar) 

Set-Acl $profilepath $Acl 


$Acl = Get-Acl $profilepathv2 

$Ar = New-Object system.security.accesscontrol.filesystemaccessrule("$logonname","FullControl","ContainerInherit, ObjectInherit", "None", "Allow") 

$Acl.AddAccessRule($Ar) 

Set-Acl $profilepathv2  $Acl


$Acl = Get-Acl $homepath

$Ar = New-Object system.security.accesscontrol.filesystemaccessrule("$logonname","FullControl","ContainerInherit, ObjectInherit", "None", "Allow") 

$Acl.AddAccessRule($Ar) 

Set-Acl $homepath $Acl  

 

 

The folder creation is fine but the permissioning goes a little wacky. It doesn't fail or give any error but when I check the permissions afterwards I find that the new user object is not listed in the security but instead there is some unknown SID with full permission. Obviously this is less than ideal.
I suspect it's because set-acl really needs an object rather than string but I don't know how either to force it to use the string, or how to convert the string to a usable object, or how to force Powershell to work it out for itself...
Any thoughts, hints, or help gratefully received.
Thanks
Neil.

Viewing all articles
Browse latest Browse all 8411

Trending Articles