Below is code I have which is executing perfectly when ran for individual servers
$Hostname = $env:COMPUTERNAME
$CsvData = Import-Csv -Path "C:\Ansible\status_report_2021.csv" | Where-Object{$_.ServerName -eq $Hostname} | Select-Object SystemFolderPath
foreach($path in $CsvData)
{
$path = $path.SystemFolderPath
$path = $path.trim('\')
# break inheritance on the folder and copy ACEs as uninherited
icacls $path /inheritance:d
#remove all BUILTIN\Users granted ACEs
icacls $path /remove:g BUILTIN\Users
#grant only BUILTIN\Users Read&Execute. avoid using (S,GE,GR) = RX.
#(S,GE,GR) is a specific right and icacls would create 2 ACEs.
#same meaning but if we can avoid it's better
icacls $path /grant:r "BUILTIN\Users:(OI)(CI)RX"
#remove SYSTEM
icacls $path /remove:g "NT AUTHORITY\SYSTEM"
#grant SYSTEM as Full control on "this folder, subfolder and files"
icacls $path /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"
icacls $path
}
Please let me know how to execute these icacls commands for remote servers.
CodePudding user response:
I guess you can use a combination of Group-Object
to group all server names and their SystemFolderPath
entries in the csv together and loop over these groups.
Inside the loop use Invoke-Command
to have the icacls
commands perform on each server.
Something like
Import-Csv -Path "C:\Ansible\status_report_2021.csv" | Group-Object ServerName | ForEach-Object {
$server = $_.Name
foreach ($path in ($_.Group.SystemFolderPath | Select-Object -Unique)) {
Invoke-Command -ComputerName $server -ScriptBlock {
param ([string]$path)
# break inheritance on the folder and copy ACEs as uninherited
icacls $path /inheritance:d
# remove all BUILTIN\Users granted ACEs
icacls $path /remove:g BUILTIN\Users
# grant only BUILTIN\Users Read&Execute. avoid using (S,GE,GR) = RX.
# (S,GE,GR) is a specific right and icacls would create 2 ACEs.
# same meaning but if we can avoid it's better
icacls $path /grant:r "BUILTIN\Users:(OI)(CI)RX"
# remove SYSTEM
icacls $path /remove:g "NT AUTHORITY\SYSTEM"
# grant SYSTEM as Full control on "this folder, subfolder and files"
icacls $path /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"
icacls $path
} -ArgumentList $path.Trim('\')
}
}
CodePudding user response:
Start by grouping all the CSV entries by server - this way we can send all the affected paths to each individual server at once:
$PathsPerServer = Import-Csv -Path "C:\Ansible\status_report_2021.csv" | Group-Object ServerName
Now we can use Invoke-Command
against each distinct server and execute the icacls statements for each relevant path:
$PathsPerServer | ForEach-Object {
# enumerate all the paths for this server, we need to pass them as arguments to Invoke-Command
$paths = $_.Group | Select-Object -Expand SystemFolderPath | ForEach-Object Trim
Invoke-Command -ComputerName $_.Name -ScriptBlock {
param([string[]]$Paths)
foreach ($path in $Paths) {
# break inheritance on the folder and copy ACEs as uninherited
icacls $path /inheritance:d
#remove all BUILTIN\Users granted ACEs
icacls $path /remove:g BUILTIN\Users
#grant only BUILTIN\Users Read&Execute. avoid using (S,GE,GR) = RX.
#(S,GE,GR) is a specific right and icacls would create 2 ACEs.
#same meaning but if we can avoid it's better
icacls $path /grant:r "BUILTIN\Users:(OI)(CI)RX"
#remove SYSTEM
icacls $path /remove:g "NT AUTHORITY\SYSTEM"
#grant SYSTEM as Full control on "this folder, subfolder and files"
icacls $path /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"
icacls $path
}
} -ArgumentList $paths
}