Filesystem Audit Powershell - Revision history

Michael.mast at 15:04, 25 February 2019

2019-02-25T15:04:41Z

Michael.mast: /* Process */

2018-06-27T12:22:25Z

Process

Michael.mast: /* Issues */

2018-06-26T14:37:09Z

Issues

Michael.mast: /* Process */

2018-06-26T14:36:13Z

Process

Michael.mast at 14:31, 26 June 2018

2018-06-26T14:31:34Z

Michael.mast: /* Process */

2018-06-26T14:31:04Z

Process

Michael.mast: Created page with "WIP, just throwing things down on paper at the moment. ==Purpose== To generate a list of permissions on a network share, dump to database, compare to list of users from AD, g..."

2018-06-26T01:03:28Z

Created page with "WIP, just throwing things down on paper at the moment. ==Purpose== To generate a list of permissions on a network share, dump to database, compare to list of users from AD, g..."

New page

WIP, just throwing things down on paper at the moment.

==Purpose==
To generate a list of permissions on a network share, dump to database, compare to list of users from AD, generate reports as to what users have access too.

==Process==
This was a an uphill battle trying to re-learn objects (It has been a while since my last need for powershell). Trying to desing a new domain forest and security groups caused me to need to understand the current deployment. The idea with the current desing was to keep things simple, but business requirements got out of hand.
<ref>https://blogs.technet.microsoft.com/zarkatech/2012/01/14/audit-file-server-permissions-using-powershell/</ref>
<pre>
(get-item \\network-share\directory).GetAccessControl() | select -ExpandProperty access | select identityreference,filesystemrights,isinherited
</pre>

For matching regex<ref>https://stackoverflow.com/questions/804754/how-do-i-return-only-the-matching-regular-expression-when-i-select-stringgrep</ref>

@@ Line 11: / Line 11: @@
 </pre>
 The full script I pulled together so far will create a CSV file<ref>https://stackoverflow.com/questions/20858133/output-powershell-variables-to-a-text-file</ref>, a row dedicated to each user/group permission. The main issue at this point is running into directories that are longer than 260 characters<ref>https://arstechnica.com/civis/viewtopic.php?t=1330043</ref>. I am running PS 5.0 and it appears I can not use unicode paths unless I upgrade to 5.1.
 <pre>
 $date1=date

@@ Line 12: / Line 12: @@
 The full script I pulled together so far will create a CSV file<ref>https://stackoverflow.com/questions/20858133/output-powershell-variables-to-a-text-file</ref>, a row dedicated to each user/group permission. The main issue at this point is running into directories that are longer than 260 characters<ref>https://arstechnica.com/civis/viewtopic.php?t=1330043</ref>. I am running PS 5.0 and it appears I can not use unicode paths unless I upgrade to 5.1.
 <pre>
-$directorylist=dir -Recurse -Directory \\network-share\directory | select fullname
+$date1=date
-"Directory|User_Group|Allow_Deny|Permissions|Inherited|Propagation" | Out-File permtest.txt
+$outfiledest="permtest2.txt"
 $directorylist | foreach {
-$directoryname=$_.fullname
+$directoryname=($_.fullname) -replace '\\\?\\UNC',''
 $perms=(Get-Item $directoryname).GetAccessControl() | select -ExpandProperty access
 $perms | foreach {
 $user= $_ | select -ExpandProperty identityreference
@@ Line 24: / Line 25: @@
 $inherit=$_ | select -ExpandProperty isinherited
 $prop=$_ |select -ExpandProperty propagationflags
-"$directoryname|$user|$allowdeny|$permissions|$inherit|$prop" | Out-File -Append permtest.txt
+"$directoryname|$user|$allowdeny|$permissions|$inherit|$prop" | Out-File -Append $outfiledest
+}
+}
 </pre>
 Next step is to convert to use a MySQL database.

@@ Line 31: / Line 31: @@
 ==Issues==
-One issue is the limited Windows API call that maxes out at 260 characters. This is a well documented problem that requires the use of unicode paths<https://blogs.msdn.microsoft.com/bclteam/2007/02/13/long-paths-in-net-part-1-of-3-kim-hamilton/</ref>
+One issue is the limited Windows API call that maxes out at 260 characters. This is a well documented problem that requires the use of unicode paths<ref>https://blogs.msdn.microsoft.com/bclteam/2007/02/13/long-paths-in-net-part-1-of-3-kim-hamilton/</ref><ref>https://stackoverflow.com/questions/46308030/handling-path-too-long-exception-with-new-psdrive/46309524</ref>
 ==Other Notes==

@@ Line 10: / Line 10: @@
 (get-item \\network-share\directory).GetAccessControl() | select -ExpandProperty access | select identityreference,filesystemrights,isinherited
 </pre>
+The full script I pulled together so far will create a CSV file<ref>https://stackoverflow.com/questions/20858133/output-powershell-variables-to-a-text-file</ref>, a row dedicated to each user/group permission. The main issue at this point is running into directories that are longer than 260 characters<ref>https://arstechnica.com/civis/viewtopic.php?t=1330043</ref>. I am running PS 5.0 and it appears I can not use unicode paths unless I upgrade to 5.1.
 ==Issues==

@@ Line 11: / Line 11: @@
 </pre>
 ==Issues==
@@ Line 19: / Line 18: @@
 I ran into a FileSystemRights setting called Synchronize<ref>https://rohnspowershellblog.wordpress.com/2015/01/16/what-does-the-synchronize-file-system-right-mean/</ref>. This is important to sync the contents of containers with the container. In other words this allows you to be able to open the contents using the path provided. Or something like that.
 <br>
 <br>
 <br>

← Older revision		Revision as of 14:31, 26 June 2018
Line 12:		Line 12:

	For matching regex<ref>https://stackoverflow.com/questions/804754/how-do-i-return-only-the-matching-regular-expression-when-i-select-stringgrep</ref>		For matching regex<ref>https://stackoverflow.com/questions/804754/how-do-i-return-only-the-matching-regular-expression-when-i-select-stringgrep</ref>
		+
		+	==Issues==
		+	One issue is the limited Windows API call that maxes out at 260 characters. This is a well documented problem that requires the use of unicode paths<https://blogs.msdn.microsoft.com/bclteam/2007/02/13/long-paths-in-net-part-1-of-3-kim-hamilton/</ref>
		+
		+	==Other Notes==
		+	I ran into a FileSystemRights setting called Synchronize<ref>https://rohnspowershellblog.wordpress.com/2015/01/16/what-does-the-synchronize-file-system-right-mean/</ref>. This is important to sync the contents of containers with the container. In other words this allows you to be able to open the contents using the path provided. Or something like that.
		+	<br>
		+	<br>
		+	<br>