Skip to content

Instantly share code, notes, and snippets.

@mortenya
Created February 17, 2016 16:19
Show Gist options
  • Save mortenya/5821bdd10bae15bac61a to your computer and use it in GitHub Desktop.
Save mortenya/5821bdd10bae15bac61a to your computer and use it in GitHub Desktop.
This is more of a POC on adding or editing ACLs via PowerShell. This will add the account 'NT AUTHORITY\System' to have FullControl access to the folder in question. This also is looking for a specific UNC, but that can easily be edited.
<#
.Synopsis
This Function will add "NT Authority\SYSTEM" to a folder ACL.
.DESCRIPTION
This Function will add "NT Authority\SYSTEM" to a folder ACL, specifically to \\folder\path\.
.EXAMPLE
Add-SystemToFolderACL \\folder\path\user1
.EXAMPLE
Add-SystemToFolderACL user1,user2
#>
function Add-SystemToFolderACL
{
[CmdletBinding()]
Param
(
# Param1 help description
[Parameter(Mandatory=$true,
Position=0)]
[Alias('Folder')]
[string[]]$Path
)
Begin
{
# settings to allow full control
$group = 'NT AUTHORITY\SYSTEM'
$rights = [System.Security.AccessControl.FileSystemRights]"FullControl"
$access = [System.Security.AccessControl.AccessControlType]::Allow
$inherit = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
$propagate = [System.Security.AccessControl.PropagationFlags]::None
$ace = New-Object System.Security.AccessControl.FileSystemAccessRule($group,$rights,$inherit,$propagate,$access)
}
Process
{
foreach ($p in $Path)
{
# Break if NT AUTHORITY\SYSTEM is already present
if ($p -like '\\folder\path\*' -and (Test-Path $p))
{
if (((get-acl $p).Access).IdentityReference -contains 'NT AUTHORITY\SYSTEM') { break }
$acl = Get-Acl $p
$acl.AddAccessRule($ace)
$acl.SetAccessRuleProtection($false,$false) # preserves inheritance ($true,$false) will disable inheritance
Set-Acl $p $acl
}
elseif (Test-Path "\\folder\path\$p")
{
if (((get-acl "\\folder\path\$p").Access).IdentityReference -contains 'NT AUTHORITY\SYSTEM') { break }
$p = "\\folder\path\$p"
$acl = Get-Acl $p
$acl.AddAccessRule($ace)
$acl.SetAccessRuleProtection($false,$false) # preserves inheritance ($true,$false) will disable inheritance
Set-Acl $p $acl
}
else
{
Write-Warning -Message "Path not found! Verify that the folder exists and is spelled correctly."
}
}
}
End{}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment