Scripted use of external executables

Question

Hello all,

I'm working on adding a folder creation step to one of our scripts which executes after account creation. When I run the commandlets themselves in Powershell, they process properly, but when I run them via Adaxes I get an error that 'You must provide a value expression on the right-hand side of the '+' operator' when trying to execute my ICACLS.exe command to create the folder and set the permissions on it.

I know the syntax for the icacls.exe command is correct as it works when run manually in Powershell, but I'm assuming I need to adjust the syntax somehow for Adaxes, or do some other step to allow Adaxes to handle execution of an external command? Perhaps the reference variables need to be named differently?

Any help would be appreciated.

Here's a snippet of the script:

$newPath = "\\server\share$\staff\" + %username%
New-Item $newPath -type directory

#Defining access rights
$UserandPerms = "domain\" + %username% + ":(OI)(CI)(M)"
icacls.exe $newPath /grant $UserandPerms

Comments

I'm going to bump this up for you, I was looking to do something similar!

---

I found this, while tring to make my script, if it helps you at all.

Running icacls under PowerShell
The options for icacls do not always run easily under PowerShell, but they can be made to work by setting a few variables and then executing with Invoke-Expression to expand all the variables:

#set PS variables for each of the icacls options
$Path = "c:\demo"   #The path must be the first thing passed to icacls
$Grant = "/grant:r"
$Remove = "/remove"
$replaceInherit = "/inheritance:r"
$permission = ":(OI)(CI)(F)"
$useraccount1 = "ss64dom\simon"
$useraccount2 = "administrators"

#run icacls using invoke Expression
Invoke-Expression -Command ('icacls $Path $replaceInherit $Grant "${useraccount1}${permission }"')

---

Ok, I just finished testing my script in Adaxes, and I use the ICACLS as well, and it worked. Hope this helps.

#Copy Home folder from Template
$user = "%samAccountName%"
$src = "\\servername\Home\Template"
$dst = "\\servername\Home\" + $user

Get-ChildItem $src | Copy-Item -Destination $dst -Force

# This turns off inherited permissions from the top level folder {Need this if you want to remove any inherited perms}
$acl = Get-ACL -Path $dst
$acl.SetAccessRuleProtection($True, $True)
Set-Acl -Path $dst -AclObject $acl

# This removes the permission from the folder 
ICACLS ("$dst") /remove:g:d "Everyone"
ICACLS ("$dst") /remove:g:d "Someuser"
ICACLS ("$dst") /remove:g:d "Adaxes User"

---

Yes, I was able to get this to work using your method. I don't really understand why my syntax doesn't work, I'm guessing it's something about how the variables are passed vs how they're structured when I run it straight in powershell, but it's working regardless. Thanks for your help!

---

No problem! Helped me do what I've been looking to do as well!

---

I found that using ICACLS does the job, but when you look at the permissions on the folder, they are all listed as "Special Permissions". Functionally sufficient, but somewhat annoying if you have Help desk folks just checking to see if someone has rights.
I found that using the cmdlets in PowerShell actually listed the rights properly after execution. Figure I'd include what I found, and what I'm using. This is assuming you're creating the User's folder directly at the \\server\share path.

$acl = Get-Acl \\SERVER\SHARE\%username%
$acl.SetAccessRuleProtection($True, $False)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(“ADMINISTRATORS”,”FullControl”, “ContainerInherit, ObjectInherit”, “None”, “Allow”)
$acl.AddAccessRule($rule)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(“HELPDESK”,”FullControl”, “ContainerInherit, ObjectInherit”, “None”, “Allow”)
$acl.AddAccessRule($rule)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("DOMAIN\%username%",”Read,Write,Delete,Modify”, “ContainerInherit, ObjectInherit”, “None”, “Allow”)
$acl.AddAccessRule($rule)
Set-Acl \\SERVER\SHARE\%username% $acl