Good Evening all. I am currently trying to figure out how to either 1) replace the existing Everyone group on the Print$ share with Authenticated Users or 2) use PowerShell to add Authenticated Users with Read access to print$ share. I have used some resources available on the net and I am able to now remove the Everyone group from the Share, but I have been unable to find a way to add Authenticated Users. Any help would be greatly appreciated. here is the code I am using currently.
###################################################################################
# #
# Script to remove Everyone from a share and replace it with Authenticated Users. #
# #
###################################################################################
function GetSecurityDescriptor($ShareName)
{
$LSSS = Get-WmiObject -Class "Win32_LogicalShareSecuritySetting" -computername $computer | where {$_.Name -eq $shareName}
$Result = $LSSS.GetSecurityDescriptor()
if($Result.ReturnValue -ne 0)
{
throw "GetSecurityDescriptor Failed"
}
# if return value is 0, then we can get its security descriptor
$SecDescriptor = $Result.Descriptor
return $SecDescriptor
}
function SetShareInfo($ShareName,$SecDescriptor)
{
$Share = Get-WmiObject -Class "Win32_Share" -computername $Computer | where {$_.Name -eq $shareName}
$MaximumAllowed = [System.UInt32]::MaxValue
$Description = "After remove permission"
$Access = $SecDescriptor
$Result = $Share.SetShareInfo($MaximumAllowed,$Description,$Access)
if($Result.ReturnValue -ne 0)
{
throw "SetShareInfo Failed"
}
"Success!"
}
function GetIndexOf($DACLs,$Domain,$Username)
{
$Index = -1;
for($i = 0; $i -le ($DACLs.Count - 1); $i += 1)
{
$Trustee = $DACLs[$i].Trustee
$CurrentDomain = $Trustee.Domain
$CurrentUsername = $Trustee.Name
if($CurrentUsername -eq $Username)
{
$Index = $i
}
}
return $Index
}
function RemoveDACL($DACLs,$Index)
{
if($Index -eq 0)
{
$RequiredDACLs = $DACLs[1..($DACLs.Count-1)]
}
elseif ($Index -eq ($DACLs.Count-1))
{
$RequiredDACLs = $DACLs[0..($DACLs.Count-2)]
}
else
{
$RequiredDACLs = $DACLs[0..($Index-1) + ($Index+1)..($DACLs.Count-1)]
}
return $RequiredDACLs
}
function RemoveSharePermissionOf($Domain,$Username,$ShareName)
{
$SecDescriptor = GetSecurityDescriptor $ShareName
# get DACL
$DACLs = $SecDescriptor.DACL
# no DACL
if($DACLs -eq $null)
{
"$ShareName doesn't have DACL"
return
}
# find the specific DACL index
$Index = GetIndexOf $DACLs $Domain $Username
# not found
if($Index -eq -1)
{
"User $Domain\$Username Not Found on Share $ShareName"
return
}
# remove specific DACL
if(($DACLs.Count -eq 1) -and ($Index -eq 0))
{
$RequiredDACLs = $null
}
else
{
$RequiredDACLs = RemoveDACL $DACLs $Index
}
# set DACL
$SecDescriptor.DACL = $RequiredDACLs
SetShareInfo $ShareName $SecDescriptor
}
$Domain=""
$Username="Everyone"
$ShareName="Print$"
$ComputerList = Get-Content c:\Print-input.txt
ForEach ($Computer in $ComputerList)
{
RemoveSharePermissionOf $Domain $Username $ShareName
}
Thank you all.
Kevin