1

In a Windows Server & Active Directory environment, where a particular network-share is shared with only certain AD users/groups. Is there a way, using PowerShell, to find out who has read permissions to this share? I tried to follow the instructions on this post, but receive an error, which is shown below after the code sample.

Here is the sample .ps1 code I used to try this:

$cred = Get-Credential -Credential mydomain\myself
$share = "MyTarget"
$cn = "FooBar"

$query = "Associators of {win32_LogicalShareSecuritySetting='$share'} 
    Where resultclass = win32_sid"

Get-WmiObject -query $query -cn $cn -cred $cred | 
    Select-Object -Property @{LABEL="User";EXPRESSION=
        {"{0}\{1}" -f $_.ReferencedDomainName, $_.AccountName}}, SID

Here is the error message:

Get-WmiObject : Not found 
At line:8 char:1
+ Get-WmiObject -query $query -cn $cn -cred $cred |
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

UPDATE: Per the comment below, I have found that the share I'm looking for is a sub-folder of an actual named share, 2 levels down. Using this line of PowerShell to find that server's named shares:

Get-WmiObject -ComputerName "FooBar" -Class win32_LogicalShareSecuritySetting | select PATH

So for example: Computer name is FooBar. One of the many listed shares is MainShare. Under that folder, we go \SomeStuff\MyTarget, and MyTarget is the folder I need to look at permissions for. So the full path would be \\FooBar\MainShare\SomeStuff\MyTarget.

  • 1
    Are you sure the $share name is correct and you have the right credentials to access it? The code works for me. If i change $share to something that doesnt exist then I get the same error you got. If you run Get-WmiObject -ComputerName <computername> -Class win32_LogicalShareSecuritySetting | select PATH do you get a list of the share names back? – Mass Nerder Jun 24 '16 at 21:59
  • @MassNerder that's an excellent check -- I did that and found that the folder I'm looking for was NOT listed. It's under a shared folder, so now I need to figure out how to... recurse? Get child shares? Let me add that to the question. Thanks! – NateJ Jun 24 '16 at 22:11
  • The share and the share permissions are set on MainShare. If you want share permissions on \\FooBar\MainShare\SomeStuff\MyTarget then you would have to create a new share point directly to that folder – Mass Nerder Jun 24 '16 at 22:38
  • Good info sir! If you want to enter it as the official answer, I'd be happy to mark it as such. Cheers! – NateJ Jun 24 '16 at 22:55
  • Glad I could help – Mass Nerder Jun 24 '16 at 23:01
1

The share and the share permissions are set on MainShare. If you want share permissions on \FooBar\MainShare\SomeStuff\MyTarget then you would have to create a new share point directly to that folder

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.