Cloning share permissions from NTFS permissions on remote servers

As a system administrator, you may encounter situations where adding "Everyone" share permissions is not an option due to security settings. In these cases, you may need to clone the existing NTFS permissions to the share permissions in order to give the appropriate users access to the shared folder. In this blog post, we will discuss a script that automates this process for multiple remote servers.

The process involves looping through each server in the list, then looping through each shared folder on that server and outputting the server name, share name, and folder path.

The script then sets a list of forbidden folders, which are not allowed to have their NTFS permissions cloned to share permissions. If the folder path is not in the list of forbidden folders, the script continues to execute.

Next, the script defines a block of code (a script block) that will be executed on the remote server. This script block starts by getting the NTFS security descriptor for the folder and extracting the access control entries (ACEs) from the descriptor.

The ACEs are then looped through, and the corresponding share permission is granted for each ACE using the Grant-SmbShareAccess cmdlet. The script also handles converting the NTFS permission to the appropriate share permission by using a switch statement.

Finally, the script block is executed on the remote server using the Invoke-Command cmdlet, passing in the required arguments for $folderPath and $ShareName.

Overall, this script allows administrators to easily clone NTFS permissions to share permissions on multiple remote servers, saving time and effort compared to manually setting share permissions, Enjoy!

# Set the list of servers

$serverList = "server1", "server2", "server3"

# Loop through each server

foreach ($server in $serverList) {

    # Get the list of shared folders on the server

    $shares = Get-SmbShare -CimSession $server

    # Loop through each shared folder and output the name and folder path

    foreach ($share in $shares) {

        Write-Output "Server: $server, Share Name: $($share.Name), Folder Path: $($share.Path)"

        # Set the script block to execute on the remote servers

            $folderPath =$($share.Path)

    #Get-Acl -Path $folder

    "Folder Path is $folderPath "

    $ShareName=$($share.Name)

    # Set the list of values to compare against

$forbiddenFolders = "", "C:\", "C:\Windows", "D:\", "E:\", "C:\excludemeyall", "F:\", "G:\", "H:\", "I:\", "J:\", "K:\", "L:\", "M:\", "N:\", "O:\", "P:\", "Q:\", "R:\", "S:\", "T:\", "U:\", "V:\", "W:\", "X:\", "Y:\", "Z:\"

if ($forbiddenFolders -contains $folderPath){ Write-Host "$folderPath is not allowed" -ForegroundColor Red}

# Check if the variable is not equal to any of the allowed values

if (-not($forbiddenFolders -contains $folderPath)) {

    # Perform an action if the variable is not equal to any of the allowed values

    Write-Host "$folderPath is  allowed" -ForegroundColor Green

    if($folderPath){

$scriptBlock = {

    param($folderPath, $ShareName)

    # Get the NTFS security descriptor for the folder

    $ntfsSecurityDescriptor = Get-Acl -Path $folderPath

    # Get the access control entries (ACEs) from the security descriptor

    $ntfsAccessControlEntries = $ntfsSecurityDescriptor.Access | Where-Object {$_.IsInherited -eq $false}

    # Loop through each ACE and grant the corresponding share permissions using the Grant-SmbShareAccess cmdlet

    foreach ($ace in $ntfsAccessControlEntries) {

        $user = $ace.IdentityReference

        $ntfsPermission = $ace.FileSystemRights

        switch($ntfsPermission){

            "ReadAndExecute" {$sharePermission="Read"}

            "ReadAndExecute, Synchronize" {$sharePermission ="Read"}

            "ReadAndExecute, Synchronize, Write" {$sharePermission= "Change"}

            "ReadAndExecute, Synchronize, Write, Modify, ReadPermissions" {$sharePermission="Full"}

            "ReadAndExecute, Synchronize, Write, Modify, ReadPermissions" {$sharePermission="Full"}

            "FullControl" {$sharePermission="Full"}

        }

        Write-Output "User: $user, NTFS Permission: $ntfsPermission, Share Permission: $sharePermission"

        if ($sharePermission) {

           Grant-SmbShareAccess -Name $ShareName -AccountName $user -AccessRight $sharePermission -Confirm:$false

        }

    }

}

}

}

if (-not($forbiddenFolders -contains $folderPath)) {

if($folderPath){

 Invoke-Command -ComputerName $server -ScriptBlock $scriptBlock -ArgumentList $folderPath, $ShareName

 }

 }

    }

   

}