共享文件区 - 如何改进我的 PowerShell 脚本？

Question

I am trying to make a script that creates file areas for different groups in a company. All the members in the group need to have full access to the shared files, but any member from the other groups can not have access - not even see them. This is what I have. For the "Limit access" section you need to change up the name of the group, and repeat this for each group. Can I put this in a foreach loop?

I am new to Powershell and really want to learn how to improve my script. So how can I improve and automate this code?

# Creates file areas
$folders = ('C:\shares\it-drift','C:\shares\dev-team','C:\shares\regnskap','C:\shares\renhold','C:\shares\HR')
mkdir -path $folders
$folders | Where-Object {$_ -like "*shares*"} | ForEach-Object {$name = (Get-Item $_).name; $DfsPath = (‘\\sec.core\files\’ + $name); $targetPath = (‘\\dc1\’ + $name);New-DfsnFolderTarget -Path $dfsPath -TargetPath $targetPath}

# Limits access
$folder = ('C:\shares\dev-team') 
$ACL = Get-Acl -path \\sec.core\files\dev-team
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("sec.core\g_dev_team","FullControl","Allow")
$ACL.SetAccessRule($AccessRule)
$ACL | Set-Acl -Path "\\sec.core\files\dev-team"
$ACL.SetAccessRuleProtection($true,$true)
$ACL = Get-Acl "\\sec.core\files\dev-team"
$ACL.Access | where {$_.IdentityReference -eq "BUILTIN\Users" } | foreach { $acl.RemoveAccessRuleSpecific($_) }
Set-Acl "\\sec.core\files\dev-team" $acl
(Get-ACL -Path "\\sec.core\files\dev-team").Access | Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize

Appreciate all tips:)

Answer 1

Here is how you can automate set of the same ACL for each shared folder:

# Creates file areas
$folders = @(
    'C:\shares\it-drift'
    'C:\shares\dev-team'
    'C:\shares\regnskap'
    'C:\shares\renhold'
    'C:\shares\HR'
)

mkdir -path $folders

$folders | Where-Object {$_ -like "*shares*"} | 
    ForEach-Object {
        $name = (Get-Item $_).name
        $DfsPath = '\\sec.core\files\' + $name
        $targetPath = '\\dc1\' + $name
        New-DfsnFolderTarget -Path $dfsPath -TargetPath $targetPath
    }

# Limits access
foreach($folder in $folders)
{
    $leaf = Split-Path $folder -Leaf
    $path="\\sec.core\files\$leaf"
    $acl = Get-Acl -Path $path
    $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("sec.core\g_dev_team","FullControl","Allow")
    $acl.SetAccessRule($AccessRule)
    Set-Acl -Path $path -AclObject $acl
    $acl.SetAccessRuleProtection($true,$true)
    $acl = Get-Acl "\\sec.core\files\dev-team"
    $acl.Access.where({$_.IdentityReference -eq "BUILTIN\Users"}).foreach({
        $acl.RemoveAccessRuleSpecific($_)
    })
    Set-Acl -Path $path -AclObject $acl
    (Get-ACL -Path $path).Access |
        Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize
}

Try to use vertical coding instead of horizontal coding. People reading your code will be thankful.