We have a document management system that has million of files on a NTFS file system accessed through a network share. A single service account needs full permission to all of these files and the application brokers access using this service account.
During a migration of data, something happened and the permissions are now inconsistent.
I've been trying to write a script in PowerShell to identify which files don't have the appropriate ACE, but get-acl
is somewhat...painful.
I've tried various combinations similar to:
get-childitem -recurse | get-acl | select -expandproperty access |
where { $_.$_.IdentityReference -notcontains $principal
where $Principal is the user that needs permission in domain\user
format.
There's got to be a way to do this, right? What is it? I'd like to keep it native to PowerShell and not use icacls
or cacls
if possible.