Filesystem Audit Powershell

WIP, just throwing things down on paper at the moment.

Purpose

To generate a list of permissions on a network share, dump to database, compare to list of users from AD, generate reports as to what users have access too.

Process

This was a an uphill battle trying to re-learn objects (It has been a while since my last need for powershell). Trying to desing a new domain forest and security groups caused me to need to understand the current deployment. The idea with the current desing was to keep things simple, but business requirements got out of hand.

(get-item \\network-share\directory).GetAccessControl() | select -ExpandProperty access | select identityreference,filesystemrights,isinherited

The full script I pulled together so far will create a CSV file, a row dedicated to each user/group permission. The main issue at this point is running into directories that are longer than 260 characters. I am running PS 5.0 and it appears I can not use unicode paths unless I upgrade to 5.1.

• NOTE : In the example below, it is important to note that you must use "\\?\UNC\" before your UNC path. This specifies that you are using a UNC path and must not be omitted.

$date1=date
$outfiledest="permtest2.txt"
$directorylist=dir -Recurse -Directory -LiteralPath '\\?\UNC\network-share\directory\' | select fullname
"Directory|User_Group|Allow_Deny|Permissions|Inherited|Propagation" | Out-File $outfiledest
$directorylist | foreach {
$directoryname=($_.fullname) -replace '\\\?\\UNC',''
$perms=(Get-Item $directoryname).GetAccessControl() | select -ExpandProperty access
$perms | foreach {
$user= $_ | select -ExpandProperty identityreference
$allowdeny=$_ | select -ExpandProperty accesscontroltype
$permissions=$_ | select -ExpandProperty filesystemrights
$inherit=$_ | select -ExpandProperty isinherited
$prop=$_ |select -ExpandProperty propagationflags
"$directoryname|$user|$allowdeny|$permissions|$inherit|$prop" | Out-File -Append $outfiledest
}
}
$date2=date
$span=new-timespan -start $date1 -End $date2
$hours=$span.Hours
$minutes=$span.Minutes
$seconds=$span.seconds
echo "$hours $minutes $seconds"

Next step is to convert to use a MySQL database.

Issues

One issue is the limited Windows API call that maxes out at 260 characters. This is a well documented problem that requires the use of unicode paths

Other Notes

I ran into a FileSystemRights setting called Synchronize. This is important to sync the contents of containers with the container. In other words this allows you to be able to open the contents using the path provided. Or something like that.

For matching regex