With Active Directory I can manually create new users. Every time I do that, I use right click -> Copy
on that user, then I modify some things like Name, Surname and SamAccountName. This process creates a new user with common properties with the copied user and also a home folder in our NAS (with path $NAS_path
). I created a script to automate that and it works. The fundamental part of it is
$templateUser = Get-ADUser -Identity $usertocopy -Properties ObjectCategory, ObjectClass, PrincipalsAllowedToDelegateToAccount
New-ADUser -Name "$($user_name) $($user_surname)" -GivenName $user_name -Surname $user_surename -Description "employee" -SamAccountName $user_domain_name -UserPrincipalName "$($user_domain_name)@myorg" -HomeDirectory "$($NAS_path)\$($user_domain_name)" -HomeDrive "W:" -Accountpassword $password -ChangePasswordAtLogon $true -Instance $templateUser
For the most part I'm ok with the result. But it just creates a new user, how can I create a folder in the NAS with "similar" permissions for the new user? By "similar" I mean that the new user can do the same things with their new folder that the old user can do with their folder. Those are the permissions of the folder \\NASPATH\test.test
of the user with SamAccountName test.test
:
Get-Acl \\NASPATH\test.test | Format-List
Path : Microsoft.PowerShell.Core\FileSystem::\\NASPATH\test.test
Owner : BUILTIN\Administrators
Group : MYORG\Domain Users
Access : BUILTIN\Administrators Allow 268435456
BUILTIN\Administrators Allow FullControl
MYORG\test.test Allow 268435456
MYORG\test.test Allow FullControl
BUILTIN\Administrators Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
CREATOR OWNER Allow FullControl
MYORG\ouradmin Allow FullControl
Audit :
Sddl : O:BAG:DUD:AI(A;OICIIO;GA;;;BA)(A;;FA;;;BA)(A;OICIIO;GA;;;S-1-5-21-2801405462-3170940757-3729986713-3219)(A;;FA
;;;S-1-5-21-2801405462-3170940757-3729986713-3219)(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIIOID;FA;;;CO)(A;O
ICIID;FA;;;S-1-5-21-2801405462-3170940757-3729986713-1530)