Let me first say thank you in advance for your help.
We have stood up a new forest, we will say ABC.
We also have our original forest , we will sat MSC.
There is an intrinsic trust between the domains, and all Users and Groups have been migrated from MSC to ABC.
We have an EMC File Server which has home folders and department shares. I created a PowerShell Script to read each folder and perform a Get-ACL which created a CSV file with the Users/Groups names, Filesystem Rights, Inheritance, Propagation flags,
Access Control Type.
What I am trying to do, add the same users/Groups from new Domain ABC with the same ACL Security as the corresponding Security from Domain MSC. This will then Dual ACL the File Server with both domains.
The CSV file I created has most of the information I need.
This is the error I am getting when running the script;
Set-acl : AclObject
At \\rtihomenas\Public\MIS\Network-Telecomm\citrix\Scripts\scripts\IsilonACLApply.ps1:51 char:29
+ ... Set-acl $FilePath $ACLRule
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (System.Security...ystemAccessRule:FileSystemAccessRule) [Set-Acl], ArgumentException
+ FullyQualifiedErrorId : SetAcl_AclObject,Microsoft.PowerShell.Commands.SetAclCommand
Below is my script;
Connect-QADService -service DomCtrl.ABC.US –proxy -credential ABC\adm.AdminUser1
$InFile = "C:\Shares\Folders.csv"
$file = import-csv $InFile
foreach($Sec in $file) {
$FilePath = $Sec.Folder_Path
$IDRef = $Sec.IdentityReference
$ACCType = $Sec.AccessControlType
$FSType = $Sec.FileSystemRights
$IsInhert = $IsInherit
$InhertFlg = $Sec.InheritanceFlags
$PFlags = $Sec.PropagationFlags
$ObjInheritFlg = $Sec.ObjectInhert
#This line will get the account/group from Domain ABC.
$objGroup = Get-QADGroup -Identity $IDRef | Select-Object -ExpandProperty SamAccountName
$objADGroup = $objGroup
Write-Host "Name is: " $objADGroup
$Matches = $objADGroup -match $IDRef.trimstart("ABC\")
If ($Matches -eq $True) {
$objGrp = New-Object System.Security.Principal.NTAccount "$objGroup"
Write-Host "Name is " $objGrp
$colRights = [System.Security.AccessControl.FileSystemRights]::$FSType
Write-Host "FileSystem Type: " $colRights
$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit,[System.Security.AccessControl.InheritanceFlags]::ObjectInherit
Write-Host "Inheritence: " $InheritanceFlag
$PropagationFlag = [system.security.accesscontrol.PropagationFlags]::None
Write-Host "Propagation Flag: " $PropagationFlag
$objType = [System.Security.AccessControl.AccessControlType]::$ACCType
Write-Host "Account Type: "$objType
#$ACLRule = New-Object System.Security.AccessControl.FileSystemAccessRule($objGroup,$colRights,$InheritanceFlag,"None",$objType)
#Add this line to explicitly add the Rights
$ACLRule = New-Object System.Security.AccessControl.FileSystemAccessRule("ABC-File Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
#($objGrp,$colRights,$InheritanceFlag,"None",$objType)
$Fldracl = get-acl $FilePath
$Fldracl.AddAccessRule($ACLrule)
Set-acl -Path $FilePath -aclObject $ACLRule
}
}
Any help that you can provide will be greatly appreciated.