如何用此对象的“替换所有子对象权限”条目替换所有子对象许可条目。使用PowerShell访问ACL文件夹

Question

我正在尝试使用PowerShell启用“将所有子对象许可条目替换为来自此对象的可继承权限条目”，下面是我的脚本

$ProfileDir = 'C:\Users\'
$Profiles = Get-ChildItem $ProfileDir \ Select-Object -ExpandProperty Name

ForEach ($X in $Profiles) 
{
    $Profile = $ProfileDir + $X 
    Write-Host "Starting $Profile"

    $Acl = Get-Acl $Profile
    $Acl.SetAccessRuleProtection($false, $true)
    (Get-Item $Profile).SetAccessControl($Acl)

    $Permissions = (Get-Acl $Profile).Access | Where-Object 
    { 
        (-not $_.isInherited) -and $_.IdentityReference -like "domain\*"
    } 
    ForEach ($Y in $Permissions) 
    {
        $Acl.AddAccessRule($Y) 
    }
    
    (Get-Item $Profile).SetAccessRule($Acl)
    (Get-Acl $Profile).Access
}

Answer 1

Below is the script I have created and it worked as expected. 

感谢您的建议和帮助。为了替换所有子对象，我已经用-Recurse使用了get -childitem，并且可以使用。

$objName = (Get-CimInstance -ClassName Win32_ComputerSystem).UserName.Split("\")[1]
$objDir = "C:\Users\$objName\"
$objUser = (Get-CimInstance -ClassName Win32_ComputerSystem).UserName
$objAccount = New-Object System.Security.Principal.NTAccount($objUser)
$objRule = $objUser,"FullControl","ContainerInherit,ObjectInherit","None","Allow"
$objFileSec = New-Object System.Security.AccessControl.FileSecurity
$objAccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($objRule)
$objFileSec.SetOwner($objAccount)
$objAclSec = Get-Acl $objDir
$objAclSec.SetAccessRuleProtection($true,$true)
$objAclSec.PurgeAccessRules($objAccount)
$objAclSec.SetAccessRule($objAccessRule)
Get-ChildItem -Path $objDir | Set-Acl -AclObject $objAclSec
$objAclSec.Access | Format-Table
Pause