Difference between revisions of "Filesystem Audit Powershell"
Michael.mast (talk | contribs) |
Michael.mast (talk | contribs) (→Issues) |
||
| Line 31: | Line 31: | ||
==Issues== | ==Issues== | ||
| − | One issue is the limited Windows API call that maxes out at 260 characters. This is a well documented problem that requires the use of unicode paths<https://blogs.msdn.microsoft.com/bclteam/2007/02/13/long-paths-in-net-part-1-of-3-kim-hamilton/</ref> | + | One issue is the limited Windows API call that maxes out at 260 characters. This is a well documented problem that requires the use of unicode paths<ref>https://blogs.msdn.microsoft.com/bclteam/2007/02/13/long-paths-in-net-part-1-of-3-kim-hamilton/</ref><ref>https://stackoverflow.com/questions/46308030/handling-path-too-long-exception-with-new-psdrive/46309524</ref> |
==Other Notes== | ==Other Notes== | ||
Revision as of 09:37, 26 June 2018
WIP, just throwing things down on paper at the moment.
Contents
Purpose
To generate a list of permissions on a network share, dump to database, compare to list of users from AD, generate reports as to what users have access too.
Process
This was a an uphill battle trying to re-learn objects (It has been a while since my last need for powershell). Trying to desing a new domain forest and security groups caused me to need to understand the current deployment. The idea with the current desing was to keep things simple, but business requirements got out of hand. [1]
(get-item \\network-share\directory).GetAccessControl() | select -ExpandProperty access | select identityreference,filesystemrights,isinherited
The full script I pulled together so far will create a CSV file[2], a row dedicated to each user/group permission. The main issue at this point is running into directories that are longer than 260 characters[3]. I am running PS 5.0 and it appears I can not use unicode paths unless I upgrade to 5.1.
$directorylist=dir -Recurse -Directory \\network-share\directory | select fullname
"Directory|User_Group|Allow_Deny|Permissions|Inherited|Propagation" | Out-File permtest.txt
$directorylist | foreach {
$directoryname=$_.fullname
$perms=(Get-Item $directoryname).GetAccessControl() | select -ExpandProperty access
$count=0
$perms | foreach {
$user= $_ | select -ExpandProperty identityreference
$allowdeny=$_ | select -ExpandProperty accesscontroltype
$permissions=$_ | select -ExpandProperty filesystemrights
$inherit=$_ | select -ExpandProperty isinherited
$prop=$_ |select -ExpandProperty propagationflags
"$directoryname|$user|$allowdeny|$permissions|$inherit|$prop" | Out-File -Append permtest.txt
}
}
Next step is to convert to use a MySQL database.
Issues
One issue is the limited Windows API call that maxes out at 260 characters. This is a well documented problem that requires the use of unicode paths[4][5]
Other Notes
I ran into a FileSystemRights setting called Synchronize[6]. This is important to sync the contents of containers with the container. In other words this allows you to be able to open the contents using the path provided. Or something like that.
For matching regex[7]
- ↑ https://blogs.technet.microsoft.com/zarkatech/2012/01/14/audit-file-server-permissions-using-powershell/
- ↑ https://stackoverflow.com/questions/20858133/output-powershell-variables-to-a-text-file
- ↑ https://arstechnica.com/civis/viewtopic.php?t=1330043
- ↑ https://blogs.msdn.microsoft.com/bclteam/2007/02/13/long-paths-in-net-part-1-of-3-kim-hamilton/
- ↑ https://stackoverflow.com/questions/46308030/handling-path-too-long-exception-with-new-psdrive/46309524
- ↑ https://rohnspowershellblog.wordpress.com/2015/01/16/what-does-the-synchronize-file-system-right-mean/
- ↑ https://stackoverflow.com/questions/804754/how-do-i-return-only-the-matching-regular-expression-when-i-select-stringgrep
