CheckProfileStoragePermissions.ps1

<# 
.SYNOPSIS 

    I used this to find inconsistent file/folder ACL for FSLogix Profile Container folders in Azure Files (Azure Storage). It's not perfect but did a good enough job. This script is highly specific for my use-case. Feel free to change it for your needs.

.DESCRIPTION 

    This script scans the specified folder for subfolders. It checks if the Owner of the subfolder has exactly "Modify, Synchronize" rights for the folder. It then checks if the subfolder-owner also has these rights for files inside that subfolder. If there is more than one (1) file in the subfolder, it throws a warning but continues.

.NOTES 
    Version 1.0

    Copyright (c) 2020 Andreas Dieckmann
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

.LINK 

    https://diecknet.de/en/2020/05/20/Check-NTFS-Permissions-Powershell/

.EXAMPLE 

    .\CheckProfileStoragePermissions.ps1 -FolderPath \\myprofilestorage12345.file.core.windows.net\profiles
    Checks the specified folder \\myprofilestorage12345.file.core.windows.net\profiles for correct permissions.

.PARAMETER FolderPath 

    -FolderPath defines the target folder that the script should check.

#>

Param([parameter(HelpMessage="Target folder to check permissions.",ValueFromPipeline=$true)]
    [String[]]
    $FolderPath=".")

# Get all subfolders
$folders = gci $FolderPath -Directory

# loop through all subfolders
foreach($folder in $folders) {
    # reset temp variables
    $acl=$null
    $owner=$null
    $ownerHasModifyRightForFolder = $false
    $ownerHasModifyRightForFiles = $false
    $ownerHasAclForFile = $false
    $color = "white"

    # get ACL and Owner of subfolder
    $acl=Get-Acl -Path $folder.FullName
    $owner=$acl.Owner
        
    # Check if subfolder Owner has "Modify, Synchronize" rights for the subfolder. Load result into $ownerHasModifyRightForFolder
    $ownerHasModifyRightForFolder = foreach($access in ($acl.Access)) {
        if(($access.IdentityReference -like $owner) -and ($access.FileSystemRights -eq "Modify, Synchronize")) {
            $true
        }
    }
    
    # Get all files in subfolder
    $files = gci $folder.FullName -File
 
    # skip if no files in folder
    if($files.count -eq 1) {
        # Loop through all files in subfolder
        foreach($file in $files) {
            # Get file ACL
            $fileAcl = Get-Acl -Path $file.FullName
            # Check if subfolder Owner has "Modify, Synchronize" rights for the file. Load result into $ownerHasModifyRightForFile
            $ownerHasModifyRightForFiles = foreach($access in ($fileAcl.Access)) {
                # if there is an ACL entry for the folder owner in this file
                if($access.IdentityReference -like $owner) {
                    $ownerHasAclForFile = $true
                    
                    # if the subfolder owner has "Modify, Synchronize" rights, then return $true - everything's allright then
                    if($access.FileSystemRights -eq "Modify, Synchronize") {
                        $true
                    }
                }
            }
        }
        # if there was no ACL entry for the file for the subfolder-owner, then set $ownerHasModifyRightForFiles to $false
        if($ownerHasAclForFile -eq $false) {
            $ownerHasModifyRightForFiles = $false
        }
    } elseif($files.count -gt 1) {
        # there shouldn't be more than one file in the subfolder
        $ownerHasModifyRightForFiles = "TOO MANY FILES"
        $color = "yellow"
    } else {
        # if no files in subfolder, set to "n/a"
        $ownerHasModifyRightForFiles = "n/a"
    }
    if($ownerHasModifyRightForFolder -eq $false -or $ownerHasModifyRightForFiles -eq $false) { $color = "red" }
    Write-Host "Folder: $($folder), Owner: $($owner), ModifyFolder: $($ownerHasModifyRightForFolder), ModifyFiles: $($ownerHasModifyRightForFiles)" -ForegroundColor $color

}