小心！我继承了重定向文件夹/主目录的权限梦night

我的新雇主为数百名用户提供了文件夹重定向设置，而设置该文件夹的人并不真正知道他在做什么。结果，未遵循有关重定向文件夹/主目录权限的最佳实践。

让人们访问其重定向文件夹位置的解决方案是改为将Full Control权限（当然是NTFS权限，而不是“共享”权限）应用于Everyone根目录（“主目录”），并将其传播到根目录下的所有子文件夹和文件。 。

可能出什么问题了吧？这并不是说CEO的My Documents文件夹中有机密信息，也不是每个人都会感染CryptoWall并加密其他人的文件。对？

因此，无论如何，既然已经消除了CryptoWall感染并恢复了备份，许多人希望我们用不太可怕的方式替换当前的权限，而我不想不必在几个对话框中单击权限对话框。一百个文件夹。

PowerShell如何为我解决这个问题，并使生活值得重新生活？

感谢JScott将我引荐给System.Security.Principal...类或方法或其他类，因此一些PowerShell将一堆子文件夹中的ACL替换为适合用户主目录的ACL：

$Root = "Path to the root folder that holds all the user home directories"

$Paths = Get-ChildItem $Root | Select-Object -Property Name,FullName

$DAAR = New-Object system.security.accesscontrol.filesystemaccessrule("MyDomain\Domain Admins","FullControl","ContainerInherit, ObjectInherit","None","Allow")
#Domain Admin Access Rule.

$SysAR = New-Object system.security.accesscontrol.filesystemaccessrule("SYSTEM","FullControl","ContainerInherit, ObjectInherit","None","Allow")
#SYSTEM Access Rule.

foreach ($Folder in $Paths)
{

    Write-Host "Generating ACL for $($folder.FullName) ... "
    #For error handling purposes - not all folders will map to a user of the exact same name, this makes them easier to handle when viewing the output.

    $ACL = New-Object System.Security.AccessControl.DirectorySecurity
    #Creates a blank ACL object to add access rules into, also blanks out the ACL for each iteration of the loop.

    $objUser = New-Object System.Security.Principal.NTAccount("MyDomain\​"+$folder.name)
    #Creating the right type of User Object to feed into our ACL, and populating it with the user whose folder we're currently on.

    $UserAR = New-Object system.security.accesscontrol.filesystemaccessrule( $objuser ,"FullControl","ContainerInherit, ObjectInherit","None","Allow")
    #Access Rule for the user whose folder we're dealing with during this iteration.

    $acl.SetOwner($objUser)
    $acl.SetAccessRuleProtection($true, $false)
    #Change the inheritance/propagation settings of the folder we're dealing with

    $acl.SetAccessRule($UserAR)
    $acl.SetAccessRule($DAAR)
    $acl.SetAccessRule($SysAR)

    Write-Host "Changing ACL on $($folder.FullName) to:"
    $acl | fl
    #For error handling purposes - not all folders will map to a user of the exact same name, this makes them easier to handle when viewing the output.

    Set-Acl -Path $Folder.Fullname -ACLObject $acl

}

如果将主文件夹/重定向文件夹设置为“授予用户独占权限” ，则先前的答案将不起作用。这是因为如果选择了不建议使用的选项，则只有SYSTEM和THE USER有权访问该文件夹。这样，您就不能在不获取文件夹所有权的情况下更改权限（甚至以管理员身份）。

这是一种解决此问题而无需拥有所有权的方法。这是一个两步过程。

创建一个运行ICACLS的powershell脚本，以修改文件夹和子文件夹上的权限。

运行PSexec启动Powershell脚本。

取自并修改自：https : //mypkb.wordpress.com/2008/12/29/how-to-restore-administrators-access-to-redirected-my-documents-folder/

1创建/复制/窃取Powershell脚本（需要PS 3.0或更高版本）

#ChangePermissions.ps1
# CACLS rights are usually
# F = FullControl
# C = Change
# R = Readonly
# W = Write

$StartingDir= "c:\shares\users"   ##Path to root of users home dirs
$Principal="domain\username"    #or "administrators"
$Permission="F"

$Verify=Read-Host `n "You are about to change permissions on all" `
"files starting at"$StartingDir.ToUpper() `n "for security"`
"principal"$Principal.ToUpper() `
"with new right of"$Permission.ToUpper()"."`n `
"Do you want to continue? [Y,N]"

if ($Verify -eq "Y") {

foreach ($FOLDER in $(Get-ChildItem -path $StartingDir -directory -recurse)) {

$temp = $Folder.fullname
CACLS `"$temp`" /E /P `"${Principal}`":${Permission} >$NULL
#write-host $Folder.FullName 
}
}

2. 运行PSEXEC，它作为SYSTEM帐户运行，因此可以更改仅SYSTEM和用户有权访问的文件夹上的权限。安装并运行PSexec。https://technet.microsoft.com/zh-cn/sysinternals/bb897553.aspx

从命令行：

psexec -s -i powershell -noexit "& 'C:\Path\To\ChangePermissions.ps1'"