Question

I am stumped!

Here is what I need to do. We have migrated to a new domain, I basically need a script that we can run on a server that will re-curse all directories and files looking at the ACL’s for each. It will search the ACL for OLDDOMAIN\USER etc. if found change the ACL to NEWDOMAIN\USER but maintain all the permissions

Here is what I have so far

$access = ""
$accessarray = @()
$filesarray = @()
$permarray = @()
$filesarray = Get-ChildItem C:\Users -Recurse
ForEach($path in $filesarray) {
  $pathcheck = $path.fullname
  $access = get-acl $pathcheck
  $accessarray = $access.AccessToString.Split(",")

  foreach ($item in $accessarray) {
    if ($item -match "OLDDOMAIN") {
      Write-Host $pathcheck
      Write-Host $item
      $item = $item -replace ("OLDDOMAIN","NEWDOMAIN")
      $permarray = $item.split(” “) | where-object {$_ -ne ”“}

      foreach($perm in $permarray) {
        $ar = New-Object system.security.accesscontrol.filesystemaccessrule $perm
        $acl.SetAccessRule($ar)
        $acl | Set-Acl $pathcheck
      }
    }
  }
}

It works kind of, but the problem is that when it goes to reapply the permissions the array is not in the correct order and it fails at the set-acl command

Any ideas? Pulling my hair out here 😛

Thanks

Answer 1

$ar = New-Object system.security.accesscontrol.filesystemaccessrule $perm

The constructor for FileSystemAccessRule takes 3 arguments, and after all your splitting and foreach, $perm will have only one argument and that construction itself will fail.

Avoid the splits etc. Powershell provides you objects. Operate on them. Don’t get strings, then split etc.

You can do what you want with something like this:

gci c:\users -recurse | %{
    $acl = get-acl $_.fullname

    $acl.Access | ?{$_.IdentityReference.Value.StartsWith("OLDDOMAIN")} | %{

        $identity = $_.IdentityReference.Value -replace "OLDDOMAIN", "NEWDOMAIN"
        $permission = $identity,$_.FileSystemRights,$_.AccessControlType
        $ar = New-Object system.security.accesscontrol.filesystemaccessrule $permission
        $acl.SetAccessRule($ar)

    }

    $acl | set-acl $_.fullname
}