{"id":52453,"date":"2009-09-16T03:01:00","date_gmt":"2009-09-16T03:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2009\/09\/16\/hey-scripting-guy-can-i-apply-security-settings-for-one-folder-to-many-other-folders\/"},"modified":"2009-09-16T03:01:00","modified_gmt":"2009-09-16T03:01:00","slug":"hey-scripting-guy-can-i-apply-security-settings-for-one-folder-to-many-other-folders","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-can-i-apply-security-settings-for-one-folder-to-many-other-folders\/","title":{"rendered":"Hey, Scripting Guy! Can I Apply Security Settings for One Folder to Many Other Folders?"},"content":{"rendered":"

\n\n\n\n
Share this post: <\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD>\n<\/A><\/TD><\/TR><\/TBODY><\/TABLE><\/SPAN>\n

\"Hey,Hey, Scripting Guy! Our company is in the process of obtaining the ISO 20000 certification<\/FONT><\/A> for IT service management and as a result it seems we have to have documentation and processes in place for everything<\/EM>. In the past when I created a folder I would manually set the security when I was finished. If I had to create 15 folders, I would manually set the security on the 15 folders. Now I need to be able to show that the 15 folders have the same security settings. Do you have a script that will copy the security settings from one folder, and then apply the same security settings to 15 newly created folders? If you do, that would be awesome. If you don’t then I guess I will have to punt. \n

— SD
\n

\"Hey,Hello SD, <\/P>\n

Microsoft Scripting Guy Ed Wilson here, I have not been involved with an ISO 20000 certification process. I imagine it is a pretty cool and exciting process, so I am green with envy at your opportunity to excel in this regard. If you have been following the Scripting Guys on Twitter<\/A> you would have seen the tweet I made the other day about finally gaining access to the scripter@microsoft.com<\/A> e-mail box. The problem, as it turns out, is my mailbox was moved to a different server because I am running on the Exchange 14 dog food server<\/FONT><\/A> and also beta testing Outlook 2010. Needless to say, things get pretty exciting at times. Anyway, I am close to 500 e-mails behind in answering the scripter e-mail. I anticipate a couple of long weekends and I will be caught up-\u2013so keep the e-mails coming. I have also begun doing additional tweets because as I am writing the Hey Scripting Guy articles, I often find new ways of doing things, and I like to share them as soon as I can. So that is my excitement right now. Perhaps now you can see why I am envious of your ISO 20000 project. I guess the best I can do, is help out by proxy. So I wrote the CreateFolderSetSecurity.ps1 script just for you. <\/P>\n

The complete CreateFolderSetSecurity.ps1 script is seen here. \n

CreateFolderSetSecurity.ps1 <\/P><\/STRONG>\n

$templateFolder = “C:\\fso”
if(-not(Test-Path -path $templateFolder))
  <\/SPAN>{
    <\/SPAN>“Folder $templateFolder not found. Check path and try again.”
    <\/SPAN>Exit
  <\/SPAN>}
$templateAcl = Get-ACL -path $templateFolder
$path = “C:\\myTest”
$folderName = “TestFolder”

For($i = 0; $i -le 5 ; $i++)
{
 <\/SPAN>New-Item -path $path -name $folderName$i -itemType Directory -force
 <\/SPAN>Set-Acl -path (Join-Path -path $path -childpath $folderName$i) -aclObject $templateAcl
} \n

<\/FONT><\/FONT><\/SPAN>The first thing you need to do is to assign the path to use for the template folder. Use the $templateFolder<\/B> variable to hold the path to the template folder. The template folder is the folder that has been given the security settings you wish to duplicate. To aid in managing the security settings, you may wish to give your template folders a naming convention that will assist in keeping track of the folders. For example, something like __HRGroupTemplate<\/B> might be useful. By prefixing each folder name with a double underscore (__<\/B>), you will cause all of your template folders to percolate to the top of the folder listing in Windows Explorer. This is seen in this image: <\/P>\n

\"Image
\n

The template folder that is used in the CreateFolderSetSecurity.ps1 script is the C:\\fso<\/B> folder. The security on this folder has been modified to explicitly deny the guest user account access. This is seen here: <\/P>\n

\"Image \n

If you are using a different folder than the C:\\fso<\/B> folder for your template folder (which is more than likely), you will need to modify the line of code that is seen here: <\/P>\n

$templateFolder = “C:\\fso” \n

<\/FONT><\/SPAN>If the CreateFolderSetSecurity.ps1 Windows PowerShell script is not able to access the template folder that is referenced by the path stored in the $templateFolder<\/B> variable, the rest of the script will be meaningless. The Test-Path<\/B> cmdlet is used to determine if the template folder exists. The Test-Path<\/B> cmdlet returns true if the folder exists. It returns false if the folder does not exist.  <\/SPAN>This is seen here: <\/P>\n

PS C:\\> Test-Path -Path c:\\fso
True
PS C:\\> Test-Path -Path c:\\fso12
False
PS C:\\> \n

<\/FONT><\/SPAN>Because the Test-Path <\/B>cmdlet returns true or false, the return value can be treated as a Boolean value, and a shortcut version of the if<\/B> statement can be used. You would read the command as meaning “if the folder exists, do something.”  <\/SPAN>This is illustrated here: <\/P>\n

PS C:\\> if(Test-Path -Path c:\\fso) { “it exists” }
it exists
PS C:\\> if(Test-Path -Path c:\\fso12) { “it exists” }
PS C:\\> \n

<\/FONT><\/SPAN>If the folder does not exist, a message is displayed on the Windows PowerShell console and the script will exit. The \u2013not<\/B> operator is used to test for the absence of the folder. This is seen here: <\/P>\n

if(-not(Test-Path -path $templateFolder))
  <\/SPAN>{
    <\/SPAN>“Folder $templateFolder not found. Check path and try again.”
    <\/SPAN>Exit
  <\/SPAN>} \n

<\/FONT><\/SPAN>Once you have ensured that the template folder exists, use the Get-Acl<\/B> cmdlet to obtain the System.Security.AccessControl.DirectorySecurity<\/A> .NET Framework class. The DirectorySecurity<\/B> object will be used when setting the security on the new folders. This is seen here: <\/P>\n

$templateAcl = Get-ACL -path $templateFolder \n

<\/FONT><\/SPAN>Two more variables are assigned values. The first variable is the path that will hold the newly created folders. The Test-Path<\/B> cmdlet is not used to check for the existence of the folder referenced by the $path<\/B> variable because this folder will be created if it does not already exist. The second variable, $folderName<\/B>, holds the folder name prefix. In this example, each of the five folders that are created will begin with the name TestFolder<\/B>. This section of the script is shown here: <\/P>\n

$path = “C:\\myTest”
$folderName = “TestFolder” \n

<\/FONT><\/SPAN>To create multiple folders with the same base name, use the for<\/B> statement, which is composed of three parts. <\/P>\n

For more information on using the for<\/B> statement, check out the Hey, Scripting Guy! How Can I Use Windows PowerShell to Handle Mind-Numbing, Repetitive Tasks?<\/FONT><\/A><\/SPAN> article. \n

The opening section of the for<\/B> statement is seen here: \n

For($i = 0; $i -le 5 ; $i++)
{

\n

<\/FONT><\/SPAN>
Inside the script block (curly brackets), the New-Item<\/B> cmdlet is used to create a new directory. The path is contained in the $path<\/B> variable, and the name of the new folder is a concatenation of the folder name prefix stored in the $folderName<\/B> variable and the current value of the $i<\/B> variable. The \u2013force<\/B> parameter is used to ensure the folder will be created even if the parent folder does not exist. This line of code is seen here: <\/P>\n

 <\/SPAN>New-Item -path $path -name $folderName$i -itemType Directory \u2013force \n

<\/FONT><\/SPAN>
Once the new folder is created, the Set-Acl<\/B> cmdlet is used to set the security on the new folder. The path to the new folder is created by using the Join-Path<\/B> cmdlet. The -path<\/B> parameter of the Join-Path<\/B> cmdlet points to the parent path. The \u2013childpath<\/B> parameter points to the last portion of the folder path. Because the Join-Path<\/B> command is placed inside a set of parentheses, this part of the Set-Acl<\/B> command is evaluated first. The last parameter of the Set-Acl<\/B> cmdlet that is used is the \u2013aclObject<\/B> parameter. It receives the DirectorySecurity<\/B> object that is stored in the $templateAcl<\/B> variable. This is seen here: <\/P>\n

 <\/SPAN>Set-Acl -path (Join-Path -path $path -childpath $folderName$i) -aclObject $templateAcl
} \n

<\/FONT><\/SPAN>When the script is run, the folder structure shown here is created: <\/P>\n

\"Image \n

The last thing that needs to be done is to inspect the security on the folders to ensure that the custom access control lists were properly applied. As seen in the following image, the script worked perfectly for our purposes: <\/P>\n

\"Image \n


Well, SD, that is about all there is to copying security descriptors from a template folder and applying them to newly created folders. Thank you for the e-mail you sent to scripter@microsoft.com. <\/P>\n

If you want to know exactly what we will be looking at tomorrow, follow us on Twitter<\/A> or Facebook<\/FONT><\/A>. If you have any questions, send e-mail to us at scripter@microsoft.com<\/A> or post your questions on the Official Scripting Guys Forum<\/A>. See you tomorrow. Until then, take care.
\n

Ed Wilson and Craig Liebendorfer, Scripting Guys \n

 <\/P><\/SPAN><\/B>\n

<\/FONT><\/B><\/P><\/p>\n","protected":false},"excerpt":{"rendered":"

Share this post: Hey, Scripting Guy! Our company is in the process of obtaining the ISO 20000 certification for IT service management and as a result it seems we have to have documentation and processes in place for everything. In the past when I created a folder I would manually set the security when I […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[62,3,63,45],"class_list":["post-52453","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-dacls-and-sacls","tag-scripting-guy","tag-security","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Share this post: Hey, Scripting Guy! Our company is in the process of obtaining the ISO 20000 certification for IT service management and as a result it seems we have to have documentation and processes in place for everything. In the past when I created a folder I would manually set the security when I […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/52453","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=52453"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/52453\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=52453"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=52453"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=52453"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}