Script recommendation - Get-ACL recursively

198 views
Skip to first unread message

Mike Leone

unread,
Jul 1, 2020, 2:34:48 PM7/1/20
to NTSysAdmin, NTPowershell Mailing List
My boss asked me "Can you list all possible network drives that specific personnel have including their individual accounts?". (yeah, I know).

The best that I can come up with (outside of purchasing a commercial auditing program, which won't be happening) is to recursively walk down a shared folder structure on a file server; pull out the share and NTFS permissions; expand all the AD groups to get the list of users. Lather, rinse, repeat.

That would be because I can see in AD that user "Joe" is a member of "ShareA_RWXD". And I know where "ShareA" is. But the problem comes when "Joe" is explicitly added to the NTFS permissions of share as a user account, rather than just groups. So Joe's access is "ShareA" (easy enough gotten from Ad group membership), but also "ShareB", where he is listed explicitly, and where that sub-folder of a share doesn't inherit from above.

Far from ideal, but I have to do something, so I need to make a start. And I'd rather not invent all the wheels. Anyone know of a script that does at least something like this, that I can modify and start to get some info? I can do searches in the Gallery for Get-ACl, but if someone knows of one, that can save me time.

Thanks

--

Mike. Leone, <mailto:tur...@mike-leone.com>

PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>

This space reserved for future witticisms ...

Markus Klocker

unread,
Jul 1, 2020, 2:42:37 PM7/1/20
to ntpowe...@googlegroups.com

In my opinion the first thing that pops into my mind:
Who is those personnel of interest and why only they?

I'd go mad if someone would access a share on a system I use that might contain private data.
As a Sysadmin I'd go mad as well, cause I'm so sure that this will violate law or at leas has pretty all potential to make a case.

    Markus

--
You received this message because you are subscribed to the Google Groups "ntpowershell" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntpowershell...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ntpowershell/CAHBr%2B%2BjesT3RcGZdtp%3D1OCb7RNWjr1K%2BFm3sGMytAZouUNsfHg%40mail.gmail.com.

Mike Leone

unread,
Jul 1, 2020, 2:52:49 PM7/1/20
to NTPowershell Mailing List
On Wed, Jul 1, 2020 at 2:42 PM Markus Klocker <markus....@univie.ac.at> wrote:

In my opinion the first thing that pops into my mind:
Who is those personnel of interest and why only they?


I realize how rude this is going to sound ... I have no idea, I just do what I'm told. There was a passing reference to speaking to our legal dept about more details, so I imagine there's some sort of internal investigation going on. But I'm not privy to any details of why.
 

I'd go mad if someone would access a share on a system I use that might contain private data.


Understandable. But if it's on a company owned device (or share), then it's not that private, I wouldn't think,
 

As a Sysadmin I'd go mad as well, cause I'm so sure that this will violate law or at leas has pretty all potential to make a case.


Can't imagine how that could be valid. If the company wants to know which company folders I, asn an employee, have access to, it's their right to know. It's their data, after all ...

 Anyway, if you know of a script that would help me derive a list of users, and show the folders they have access to, and the access they have, that would be great.

Thanks

    Markus

Am 01/07/2020 um 20:34 schrieb Mike Leone:
My boss asked me "Can you list all possible network drives that specific personnel have including their individual accounts?". (yeah, I know).

The best that I can come up with (outside of purchasing a commercial auditing program, which won't be happening) is to recursively walk down a shared folder structure on a file server; pull out the share and NTFS permissions; expand all the AD groups to get the list of users. Lather, rinse, repeat.

That would be because I can see in AD that user "Joe" is a member of "ShareA_RWXD". And I know where "ShareA" is. But the problem comes when "Joe" is explicitly added to the NTFS permissions of share as a user account, rather than just groups. So Joe's access is "ShareA" (easy enough gotten from Ad group membership), but also "ShareB", where he is listed explicitly, and where that sub-folder of a share doesn't inherit from above.

Far from ideal, but I have to do something, so I need to make a start. And I'd rather not invent all the wheels. Anyone know of a script that does at least something like this, that I can modify and start to get some info? I can do searches in the Gallery for Get-ACl, but if someone knows of one, that can save me time.

Thanks

--

Mike. Leone, <mailto:tur...@mike-leone.com>

PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>

This space reserved for future witticisms ...
--
You received this message because you are subscribed to the Google Groups "ntpowershell" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntpowershell...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ntpowershell/CAHBr%2B%2BjesT3RcGZdtp%3D1OCb7RNWjr1K%2BFm3sGMytAZouUNsfHg%40mail.gmail.com.

--
You received this message because you are subscribed to the Google Groups "ntpowershell" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntpowershell...@googlegroups.com.

Michael B. Smith

unread,
Jul 1, 2020, 2:56:51 PM7/1/20
to ntpowe...@googlegroups.com, NTSysAdmin

You can shortcut a great deal of that effort by using Get-SmbShare which lists all the file shares on a computer and the DACL that applies to it.

 

You convert DACLs to readable strings using ConvertFrom-Sddl.

 

Get-SmbShare works on remote systems using CimSession, if you have remote management enabled. If not, you can use “net share” on downlevel computers.

--

Michael B. Smith

unread,
Jul 1, 2020, 2:59:10 PM7/1/20
to ntpowe...@googlegroups.com

In Markus’ defense, EU laws are significantly more protective of the individual than are American laws.

 

Mike Leone

unread,
Jul 1, 2020, 3:03:55 PM7/1/20
to NTPowershell Mailing List
On Wed, Jul 1, 2020 at 2:59 PM Michael B. Smith <mic...@smithcons.com> wrote:

In Markus’ defense, EU laws are significantly more protective of the individual than are American laws.



Yes, that occurred to me. As usual, moments after I hit "send" ...

I meant no disrespect, Markus. My apologies.

Markus Klocker

unread,
Jul 1, 2020, 3:29:06 PM7/1/20
to ntpowe...@googlegroups.com

Tru that.

My point is to be careful with collecting sensitive data.
If it is only what sources are connected... that I'd sign off right away.
Even if you use get-smbconnection or something else it has to be connected at the time you do this.
What about browser based services (or at least the possibility mycloud, ownclud, webdav....)?
If there is data exfiltration going on I'd go look at where traffic is directed to (maybe well known IPs or at least ones you find "strange").

I see many loose ends here as well as the legal issues that I would at least take a look at (EU or US cause I'd don't know US law even a bit :)).

    Markus

Mike Leone

unread,
Jul 1, 2020, 3:37:56 PM7/1/20
to NTPowershell Mailing List, NTSysAdmin
On Wed, Jul 1, 2020 at 2:56 PM Michael B. Smith <mic...@smithcons.com> wrote:

You can shortcut a great deal of that effort by using Get-SmbShare which lists all the file shares on a computer and the DACL that applies to it.

 

You convert DACLs to readable strings using ConvertFrom-Sddl.

 

Get-SmbShare works on remote systems using CimSession, if you have remote management enabled. If not, you can use “net share” on downlevel computers.


Such useful information!

But what am I doing wrong here, then?

PS C:\Windows\system32> get-smbshare -Name "TestMDT_Share" | Select -Property SecurityDescriptor | ConvertFrom-SddlString
ConvertFrom-SddlString : Exception calling ".ctor" with "3" argument(s): "The SDDL form of a security descriptor
object is invalid.
Parameter name: sddlForm"
At line:1 char:76
+ ... Share" | Select -Property SecurityDescriptor | ConvertFrom-SddlString
+                                                    ~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [ConvertFrom-SddlString], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentException,ConvertFrom-SddlString

 

 

From: ntpowe...@googlegroups.com <ntpowe...@googlegroups.com> On Behalf Of Mike Leone
Sent: Wednesday, July 1, 2020 2:35 PM
To: NTSysAdmin <ntsys...@googlegroups.com>; NTPowershell Mailing List <ntpowe...@googlegroups.com>
Subject: [ntpowershell] Script recommendation - Get-ACL recursively

 

My boss asked me "Can you list all possible network drives that specific personnel have including their individual accounts?". (yeah, I know).

 

The best that I can come up with (outside of purchasing a commercial auditing program, which won't be happening) is to recursively walk down a shared folder structure on a file server; pull out the share and NTFS permissions; expand all the AD groups to get the list of users. Lather, rinse, repeat.

 

That would be because I can see in AD that user "Joe" is a member of "ShareA_RWXD". And I know where "ShareA" is. But the problem comes when "Joe" is explicitly added to the NTFS permissions of share as a user account, rather than just groups. So Joe's access is "ShareA" (easy enough gotten from Ad group membership), but also "ShareB", where he is listed explicitly, and where that sub-folder of a share doesn't inherit from above.

 

Far from ideal, but I have to do something, so I need to make a start. And I'd rather not invent all the wheels. Anyone know of a script that does at least something like this, that I can modify and start to get some info? I can do searches in the Gallery for Get-ACl, but if someone knows of one, that can save me time.

 

Thanks

 

--


Mike. Leone, <mailto:tur...@mike-leone.com>

PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>

This space reserved for future witticisms ...

--
You received this message because you are subscribed to the Google Groups "ntpowershell" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntpowershell...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ntpowershell/CAHBr%2B%2BjesT3RcGZdtp%3D1OCb7RNWjr1K%2BFm3sGMytAZouUNsfHg%40mail.gmail.com.

--
You received this message because you are subscribed to the Google Groups "ntpowershell" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntpowershell...@googlegroups.com.

Henry Awad

unread,
Jul 1, 2020, 4:08:17 PM7/1/20
to ntsys...@googlegroups.com, NTPowershell Mailing List
Try one of these tools:


I have used Netwrix (paid version) in the past and they provide a very nice readable format report. I honestly haven't used the free version so not sure how different the report would be.

Hope this helps.

You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ntsysadmin/CAHBr%2B%2Bjn_b04320J%2BWbMZ65YbqbxJgg8Es8JNx8rDCu1R83q9w%40mail.gmail.com.

Henry Awad

unread,
Jul 1, 2020, 4:10:42 PM7/1/20
to ntsys...@googlegroups.com, NTPowershell Mailing List
And at the same end of the article in the link, it has the PoweShell script also. Just noticed that.

Michael B. Smith

unread,
Jul 1, 2020, 4:29:15 PM7/1/20
to ntsys...@googlegroups.com, NTPowershell Mailing List

The doc is wrong, you can’t pipe to ConvertFrom-Sddl.

 

$a = get-smbshare -Name "TestMDT_Share"

ConvertFrom-SddlString -sddl $a.SecurityDescriptor

 

From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> On Behalf Of Mike Leone
Sent: Wednesday, July 1, 2020 3:38 PM
To: NTPowershell Mailing List <ntpowe...@googlegroups.com>

--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ntsysadmin/CAHBr%2B%2Bjn_b04320J%2BWbMZ65YbqbxJgg8Es8JNx8rDCu1R83q9w%40mail.gmail.com.

Kurt Buff - GSEC, GCIH

unread,
Jul 1, 2020, 5:29:54 PM7/1/20
to ntpowe...@googlegroups.com
Have you taken a look at the NTFSSecurity PowerShell module?
and 

Kurt

--

Mike Leone

unread,
Jul 2, 2020, 11:43:00 AM7/2/20
to NTSysAdmin, NTPowershell Mailing List
On Wed, Jul 1, 2020 at 4:08 PM Henry Awad <aw...@cua.edu> wrote:
Try one of these tools:


I have used Netwrix (paid version) in the past and they provide a very nice readable format report. I honestly haven't used the free version so not sure how different the report would be.

Thanks, those are all helpful. The biggest problem I have is this - all these seem to mostly concentrate on the permissions of a folder. And I need the report from the other perspective - I want to put in an AD group, and have it report (for each user) all of the access for the entire server. So I put in "MaintenaceGroup", and see "User Mike -  \\Server1\ThisFolder, RWXD; \\Server1\ThatFolder, RO:, etc.

 So I still think I'll need to cobble something together, from disparate parts.

I'd love to purchase something, but I don't really see them doing that. And not in the time frame I will (probably) need it, as our purchasing department ain't exactly known for their speed ...


Mike Leone

unread,
Jul 2, 2020, 12:01:09 PM7/2/20
to NTPowershell Mailing List, ntsys...@googlegroups.com
On Wed, Jul 1, 2020 at 4:29 PM Michael B. Smith <mic...@smithcons.com> wrote:

The doc is wrong, you can’t pipe to ConvertFrom-Sddl.


Oh, goodie! LOL
 

$a = get-smbshare -Name "TestMDT_Share"

ConvertFrom-SddlString -sddl $a.SecurityDescriptor


I ended up with this (following other clues from other searching):

PS C:\Windows\system32> $SDDL = (get-smbshare -Name "TestMDT_Share" | Get-ACL).sddl
PS C:\Windows\system32> ($SDDL | ConvertFrom-SddlString -Type FileSystemRights| Select-Object -ExpandProperty Discretion
aryAcl) -split ":"
Everyone
 AccessAllowed (GenericWrite, ListDirectory, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, Synchronize, Traverse)
NT AUTHORITY\Authenticated Users
 AccessAllowed (GenericWrite, ListDirectory, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, Synchronize, Traverse)
NT AUTHORITY\SYSTEM
 AccessAllowed (ChangePermissions, CreateDirectories, Delete, DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, FullControl, FullControl, FullControl, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrite, ListDirectory, Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, Synchronize, TakeOwnership, Traverse, Write, WriteAttributes, WriteData, WriteExtendedAttributes, WriteKey)
BUILTIN\Administrators
 AccessAllowed (ChangePermissions, CreateDirectories, Delete, DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, FullControl, FullControl, FullControl, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrite, ListDirectory, Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, Synchronize, TakeOwnership, Traverse, Write, WriteAttributes, WriteData, WriteExtendedAttributes, WriteKey)
<DOMAIN\UserA>
 AccessAllowed (ChangePermissions, CreateDirectories, Delete, DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, FullControl, FullControl, FullControl, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrite, ListDirectory, Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, Synchronize, TakeOwnership, Traverse, Write, WriteAttributes, WriteData, WriteExtendedAttributes, WriteKey)


I will admit to not being entirely clear why I need to select the "DiscretionaryACL"; property I was following an example. It seems to give me all the right info, however ...

So if I follow the above, I'd need to do the above recursively for the whole file server; and if any domain entry (group or user) returned is in the group I am interested in, save that.

And eventually I'd have a table of users, and an entry for each folder they appear in (whether as a group member or explicit).

Don't think that will handle nested group memberships very well, but it's a start, I think.

Can someone explain this:

"BUILTIN\Administrators
 AccessAllowed (ChangePermissions, CreateDirectories, Delete, DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, FullControl, FullControl, FullControl, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrite, ListDirectory, Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, Synchronize, TakeOwnership, Traverse, Write, WriteAttributes, WriteData, WriteExtendedAttributes, WriteKey)"

What's with the repeated "FullControl"?  ( FullControl, FullControl, FullControl, FullControl, FullControl). I get the other accesses, but what is this? Is this due to me asking for "DiscretionaryACL"?


Michael B. Smith

unread,
Jul 2, 2020, 1:57:17 PM7/2/20
to ntpowe...@googlegroups.com, ntsys...@googlegroups.com

If you don’t select only DiscretionaryAcl, you get all the other information that the cmdlet can output.

 

Owner            : NT AUTHORITY\SYSTEM

Group            : NT AUTHORITY\SYSTEM

ControlFlags     : DiscretionaryAclPresent, SelfRelative

DiscretionaryAcl : {NT AUTHORITY\INTERACTIVE: Allow (GenericAll), BUILTIN\Administrators: Allow (GenericAll),

                   BUILTIN\Backup Operators: Allow (GenericAll)}

SystemAcl        : {}

RawDescriptor    : System.Security.AccessControl.CommonSecurityDescriptor

 

The list of FullControls means that there are ExtendedAttributes in the DACL that the ConvertFrom-Sddl cmdlet doesn’t know how to interpret. You can ignore it. If you want the exact detail, use icacls.exe. It properly displays all the extended attributes. But you can’t easily control the output format.

 

From: ntpowe...@googlegroups.com <ntpowe...@googlegroups.com> On Behalf Of Mike Leone
Sent: Thursday, July 2, 2020 12:01 PM
To: NTPowershell Mailing List <ntpowe...@googlegroups.com>

--

You received this message because you are subscribed to the Google Groups "ntpowershell" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntpowershell...@googlegroups.com.

Dennis Pinckard

unread,
Jul 2, 2020, 5:26:33 PM7/2/20
to ntpowe...@googlegroups.com

I'm going to give an answer that may get me kicked off of this group.

Purchase a commercial product. 

Yes, you can write a script to do what you want, and I'd done similar ones in the past, but you always miss something and later find an edge case that wasn't covered.  If this is a legal issue and important to the business, buy a supported commercial application where all of the leg work has been done.  When you miss an entire directory where a user had permission as part of the legal discovery process, you do NOT want to be the one held responsible.


If this is just a side project for your own use, by all means use it as a learning exercise to improve your PowerShell skills.  It can be a very educational project.

Some use cases you will need to consider:

    ACLs with direct membership of User Object

    ACLs with direct membership of Computer Object (Does the user's computer have access, which could allow the user to see it as well?)

    Direct group membership of the user as well as nested group membership

    Share and NTFS permissions

    Permissions on files.  It's not common, but certainly possible to grant perms on files.

    Directory traversal weirdness.  User has access to sub folders but not the parent.  (Can make it hard to get to, but not always impossible)

    Access granted by public groups (Domain Users, Everyone, Anonymous, ...)

    Permissions that were in effect on date X, but have been modified since.

    Hard links to a restricted folder/file (I hate it when that one bites me!)

    And then you get to the really weird stuff.  Nobody can predict it ahead of time, but trust me, that one user figured out how to do something nobody expected.

--
You received this message because you are subscribed to the Google Groups "ntpowershell" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntpowershell...@googlegroups.com.

Kurt Buff - GSEC, GCIH

unread,
Jul 2, 2020, 7:25:05 PM7/2/20
to ntpowe...@googlegroups.com
The answer won't get you kicked off, but did you notice that OP said
that a commercial product wasn't an option? Not that I don't like
commercial products, just that in this case budget likely won't be
available.

Kurt
> To view this discussion on the web visit https://groups.google.com/d/msgid/ntpowershell/a92c570f-1cb0-303f-3f60-f56ffb8bf5fa%40doomsdaypig.com.

Michael B. Smith

unread,
Jul 5, 2020, 7:14:25 PM7/5/20
to ntpowe...@googlegroups.com

What a great list!

 

No chance of you getting kicked off, and I appreciate your viewpoint.

 

I sometimes recommend a commercial product too. It all depends on what the OP asks for.

Reply all
Reply to author
Forward
0 new messages