icacls permissions script in powershell

Question

Let me start off by saying I am very new to scripting! Basically what I am trying to do is to write a script that will create all of these files: For the 13-14 in the files that is the previous and current year so I need a variable that when I run the script next year it will be 14-15. The top folders are AD,CC,DC,FS,IT,OP:

For example

• C:\Test\AD\13-14\Audit\Fir
• C:\Test\CC\13-14\OSA
• C:\Test\DC\13-14\Vendor
• C:\Test\FS\13-14\Maintenance
• C:\Test\IT\13-14\Detail
• C:\Test\OP\13-14\Training

(There are many more folders this is just an example)

The Script I have wrote that creates all of these folders so far is:

$Users = Get-Content "C:\Users\david\Desktop\PowershellFoldersDB.txt" 
ForEach ($user in $users)
{
    $newPath = Join-path "C:\Test" -childpath $user
    New-Item $newPath -type directory
}

Alright and now what I am trying to add to this is script is icacls making the Folders at the top level of categorization to be locked such that no new folders could be created, none could be deleted, and none renamed. But for folders underneath the top level I want to be able to add new folders if I need too. Any help would be greatly appreciated. Thanks

Answer 1

What you are looking for is Get-ACL and Set-ACL. You can manually setup one folder as you want it to be setup, then run Get-ACL against that to pull all the security info from it. Then you can apply that to the new folders as they are created with Set-ACL. So something like:

[int]$YY = Get-Date -f "yy"
[String]$YY = "$($YY-1)-$YY"
$ACL = Get-ACL C:\Test\Template
$ACLSub = Get-ACL "C:\Test\Template\Sub"
"AD","CC","DC","FS","IT","OP" | %{
    $CurrentRoot = New-Item "C:\Test\$_" -ItemType Directory
    $CurrentSub = New-Item "$CurrentRoot\$YY" -ItemType Directory
    $CurrentRoot | Set-ACL -AclObject $ACL
    $CurrentSub | Set-ACL -AclObject $ACLSub
}

Then you just need to setup the Template folder and the Sub folder within it to have the correct security permissions ahead of time and you are all set. It's much simpler than setting all the permissions by hand in PowerShell IMHO.

Edit: Well, considering that you have a folder list in a text file this actually becomes simpler.

$Folders  = Get-Content "C:\Users\david\Desktop\PowershellFoldersDB.txt" 
[int]$YY = Get-Date -f "yy"
[String]$YY = "$($YY-1)-$YY"
$ACL = Get-ACL C:\Test\Template
$ACLSub = Get-ACL "C:\Test\Template\Sub"
$folders |?{$_ -match "^(C:\\Test\\..)(\\\d{2}-\d{2})(\\.*)$"}|%{New-Item "$($Matches[1])\$YY$($Matches[3])" -ItemType directory -force | Out-Null}
GCI "$($matches[1])\.." -Directory | %{
    $_ | Set-ACL -AclObject $ACL
    GCI $_.FullName | Set-ACL -AclObject $ACLSub
}