fix_no_access_folders.ps1
|
<#PSScriptInfo .VERSION 1.0 .GUID 52d7a324-b4ed-4c89-95fb-64e1df90a240 .AUTHOR Paul@sexstone.com .COMPANYNAME Sexstone .COPYRIGHT .TAGS .LICENSEURI .PROJECTURI .ICONURI .EXTERNALMODULEDEPENDENCIES .REQUIREDSCRIPTS .EXTERNALSCRIPTDEPENDENCIES .RELEASENOTES #> <# .DESCRIPTION Find and fix files with broken inheritance and unable to be accessed by admin use setuptestdir.ps1 to create a demo directory to show script working safely.use setuptestdir.ps1 to create a demo directory to show script working safely. Find and fix folders with broken inheritance and unable to be accessed by admin use fix_no_access_folders.ps1 first, to makde all files visible then use fix_no_access_files.ps1 #> Param()# $MigrationAccount = 'pauls' #set the user account or group as domain\account that will be givin ownership of the files and access to them $scanroot = "C:\acltestroot" #start drive and directory path for recursion check $run_scan_only = $true # true or false : run and report scan only, recersif folders hidden will not be detected untill a fix is run # **************************************** function set-owner start Function Set-Owner { <# .SYNOPSIS Changes owner of a file or folder to another user or group. .DESCRIPTION Changes owner of a file or folder to another user or group. .PARAMETER Path The folder or file that will have the owner changed. .PARAMETER Account Optional parameter to change owner of a file or folder to specified account. Default value is 'Builtin\Administrators' .PARAMETER Recurse Recursively set ownership on subfolders and files beneath given folder. .NOTES Name: Set-Owner Author: Boe Prox Version History: 1.0 - Boe Prox - Initial Version .EXAMPLE Set-Owner -Path C:\temp\test.txt Description ----------- Changes the owner of test.txt to Builtin\Administrators .EXAMPLE Set-Owner -Path C:\temp\test.txt -Account 'Domain\bprox Description ----------- Changes the owner of test.txt to Domain\bprox .EXAMPLE Set-Owner -Path C:\temp -Recurse Description ----------- Changes the owner of all files and folders under C:\Temp to Builtin\Administrators .EXAMPLE Get-ChildItem C:\Temp | Set-Owner -Recurse -Account 'Domain\bprox' Description ----------- Changes the owner of all files and folders under C:\Temp to Domain\bprox #> [cmdletbinding( SupportsShouldProcess = $True )] Param ( [parameter(ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True)] [Alias('FullName')] [string[]]$Path, [parameter()] [string]$Account = 'Builtin\Administrators', [parameter()] [switch]$Recurse ) Begin { #Prevent Confirmation on each Write-Debug command when using -Debug If ($PSBoundParameters['Debug']) { $DebugPreference = 'Continue' } Try { [void][TokenAdjuster] } Catch { $AdjustTokenPrivileges = @" using System; using System.Runtime.InteropServices; public class TokenAdjuster { [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen); [DllImport("kernel32.dll", ExactSpelling = true)] internal static extern IntPtr GetCurrentProcess(); [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok); [DllImport("advapi32.dll", SetLastError = true)] internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid); [StructLayout(LayoutKind.Sequential, Pack = 1)] internal struct TokPriv1Luid { public int Count; public long Luid; public int Attr; } internal const int SE_PRIVILEGE_DISABLED = 0x00000000; internal const int SE_PRIVILEGE_ENABLED = 0x00000002; internal const int TOKEN_QUERY = 0x00000008; internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020; public static bool AddPrivilege(string privilege) { try { bool retVal; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_ENABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } catch (Exception ex) { throw ex; } } public static bool RemovePrivilege(string privilege) { try { bool retVal; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_DISABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } catch (Exception ex) { throw ex; } } } "@ Add-Type $AdjustTokenPrivileges } #Activate necessary admin privileges to make changes without NTFS perms [void][TokenAdjuster]::AddPrivilege("SeRestorePrivilege") #Necessary to set Owner Permissions [void][TokenAdjuster]::AddPrivilege("SeBackupPrivilege") #Necessary to bypass Traverse Checking [void][TokenAdjuster]::AddPrivilege("SeTakeOwnershipPrivilege") #Necessary to override FilePermissions } Process { ForEach ($Item in $Path) { Write-Verbose "FullName: $Item" #The ACL objects do not like being used more than once, so re-create them on the Process block $DirOwner = New-Object System.Security.AccessControl.DirectorySecurity $DirOwner.SetOwner([System.Security.Principal.NTAccount]$Account) $FileOwner = New-Object System.Security.AccessControl.FileSecurity $FileOwner.SetOwner([System.Security.Principal.NTAccount]$Account) $DirAdminAcl = New-Object System.Security.AccessControl.DirectorySecurity $FileAdminAcl = New-Object System.Security.AccessControl.DirectorySecurity $AdminACL = New-Object System.Security.AccessControl.FileSystemAccessRule('Builtin\Administrators','FullControl','ContainerInherit,ObjectInherit','InheritOnly','Allow') $FileAdminAcl.AddAccessRule($AdminACL) $DirAdminAcl.AddAccessRule($AdminACL) Try { $Item = Get-Item -LiteralPath $Item -Force -ErrorAction Stop If (-NOT $Item.PSIsContainer) { If ($PSCmdlet.ShouldProcess($Item, 'Set File Owner')) { Try { $Item.SetAccessControl($FileOwner) } Catch { Write-Warning "Couldn't take ownership of $($Item.FullName)! Taking FullControl of $($Item.Directory.FullName)" $Item.Directory.SetAccessControl($FileAdminAcl) $Item.SetAccessControl($FileOwner) } } } Else { If ($PSCmdlet.ShouldProcess($Item, 'Set Directory Owner')) { Try { $Item.SetAccessControl($DirOwner) } Catch { Write-Warning "Couldn't take ownership of $($Item.FullName)! Taking FullControl of $($Item.Parent.FullName)" $Item.Parent.SetAccessControl($DirAdminAcl) $Item.SetAccessControl($DirOwner) } } If ($Recurse) { [void]$PSBoundParameters.Remove('Path') Get-ChildItem $Item -Force | Set-Owner @PSBoundParameters } } } Catch { Write-Warning "$($Item): $($_.Exception.Message)" } } } End { #Remove priviledges that had been granted [void][TokenAdjuster]::RemovePrivilege("SeRestorePrivilege") [void][TokenAdjuster]::RemovePrivilege("SeBackupPrivilege") [void][TokenAdjuster]::RemovePrivilege("SeTakeOwnershipPrivilege") } } #********************************************* function set-owner end #find broken directories $Cyclecount = 0 Do { $Cyclecount++ Write-output " ************* START Cycle : recursive check of folder access : Scan only = $($run_scan_only) " #reset variables $inaccessiablefolder = @() $accessgranted = @() $Error.Clear() # This is a global variable! $Items = Get-ChildItem $scanroot -Directory -Recurse -ErrorAction SilentlyContinue ForEach($Err In $Error) { $Inaccessiablefolder += $Err.TargetObject } Write-output " ************* $($inaccessiablefolder.Count) folders that could not be viewed" $inaccessiablefolder #Get Owner for broken directories $Acls = ForEach ($Dir in $inaccessiablefolder) { Get-Acl $Dir -ErrorAction SilentlyContinue Select @{Name="pat";Expression={$Dir}}, Owner, AccessToString } Write-Output " ************* Owners of $($inaccessiablefolder.Count) folders that could not be viewed" $Acls if ( $run_scan_only -eq $false ) { #fix owners ForEach ($Dir in $inaccessiablefolder) { set-owner $Dir $MigrationAccount } #get permissions on fixed folder $HiddenAcls = ForEach ($Dir in $inaccessiablefolder) { Get-Acl $Dir -ErrorAction SilentlyContinue | Select @{Name="DirName";Expression={$Dir}},Owner, AccessToString, @{Name="Non-Inherited Perms";Expression={($_.Access | Where{$_.IsInherited -eq $false}) | foreach{"{0}: {1}" -f $_.IdentityReference, $_.FileSystemRights}}}, @{Name="Non-Inherited Count";Expression={($_.Access | Where{$_.IsInherited -eq $false}).Count}} } Write-output " ************* Permissions of $($inaccessiablefolder.Count) folders that could not be viewed" $HiddenAcls #Give access to migration account to blocked folder ForEach ($Dir in $inaccessiablefolder) { $acl = get-acl $Dir $acl.SetAccessRuleProtection($true,$false) $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($migrationaccount, "FullControl", "ContainerInherit,ObjectInherit", "None", "allow") $Acl.SetAccessRule($Ar) Set-Acl $dir $acl $accessgranted += $dir } Write-output " ************* Updated $($inaccessiablefolder.Count) permissions folders that could not be viewed" $accessgranted Write-output " ************* END cycle : Inaccessiable folders updated : $($inaccessiablefolder.Count) in cycle $($Cyclecount)" } #end of if for update exclusion } while ( $inaccessiablefolder.Count -gt 1 -and $run_scan_only -eq $Fales) Write-output " ************* FINISHED : recursive check cycles ended no futher inaccessbile folders found after $($Cyclecount) cycles " |