PowerShell按路径分组NTFS权限为哈希/数组格式技术求助

问题修正说明 #

你当前的代码存在3处核心问题：

• 遍历权限条目时错误使用$_.access而非循环变量$i，导致重复取整个权限集合的属性
• Get-Acl返回的Path属性带Microsoft.PowerShell.Core\FileSystem::前缀，需提取实际路径
• 未将InheritanceFlags转换为友好文本，也未添加DSC模块需要的Present标识

哈希表格式实现（推荐，便于按路径快速查找） #

# 初始化空哈希表
$ntfsPermissionsHash = @{}

# 获取目标路径的ACL并过滤指定身份的权限条目
$acl = Get-Acl "E:\DenClass"
$filteredAccessEntries = $acl.Access | 
    Where-Object { 
        $_.IdentityReference -like "$env:userdomain*" -or 
        $_.IdentityReference -like "*IIS_IUSRS*" 
    } | Sort-Object IdentityReference | Get-Unique

# 清理路径前缀，提取实际路径
$cleanPath = $acl.Path -replace '^Microsoft\.PowerShell\.Core\\FileSystem::', ''

# 遍历权限条目，构建符合需求的嵌套数组
$permissionEntries = foreach ($entry in $filteredAccessEntries) {
    # 将继承标志转换为友好文本
    $inheritanceText = switch ($entry.InheritanceFlags) {
        'ContainerInherit, ObjectInherit' { 'This Folder Subfolders And Files' }
        'ContainerInherit' { 'This Folder And Subfolders' }
        'ObjectInherit' { 'This Folder And Files' }
        default { 'This Folder Only' }
    }

    # 构建单条权限的属性数组
    @(
        $entry.IdentityReference.Value,
        $entry.AccessControlType.ToString(),
        @($entry.FileSystemRights.ToString()),
        $inheritanceText,
        'Present'
    )
}

# 将路径作为键，权限集合作为值存入哈希表
$ntfsPermissionsHash[$cleanPath] = $permissionEntries

# 输出结果
$ntfsPermissionsHash

数组格式实现 #

# 获取目标路径的ACL对象
$acl = Get-Acl "E:\DenClass"
# 清理路径前缀
$cleanPath = $acl.Path -replace '^Microsoft\.PowerShell\.Core\\FileSystem::', ''

# 过滤并处理权限条目
$permissionEntries = $acl.Access | 
    Where-Object { 
        $_.IdentityReference -like "$env:userdomain*" -or 
        $_.IdentityReference -like "*IIS_IUSRS*" 
    } | Sort-Object IdentityReference | Get-Unique |
    ForEach-Object {
        $inheritanceText = switch ($_.InheritanceFlags) {
            'ContainerInherit, ObjectInherit' { 'This Folder Subfolders And Files' }
            'ContainerInherit' { 'This Folder And Subfolders' }
            'ObjectInherit' { 'This Folder And Files' }
            default { 'This Folder Only' }
        }
        @(
            $_.IdentityReference.Value,
            $_.AccessControlType.ToString(),
            @($_.FileSystemRights.ToString()),
            $inheritanceText,
            'Present'
        )
    }

# 构建最终数组结构
$ntfsPermissionsArray = @(
    @($cleanPath, $permissionEntries)
)

# 输出结果
$ntfsPermissionsArray

多路径批量处理扩展 #

如果需要同时处理多个目录，只需循环遍历路径列表即可：

# 定义需要处理的路径集合
$targetPaths = @("E:\DenClass", "E:\Path2", "E:\AnotherFolder")
$ntfsPermissionsHash = @{}

foreach ($path in $targetPaths) {
    $acl = Get-Acl $path
    $cleanPath = $acl.Path -replace '^Microsoft\.PowerShell\.Core\\FileSystem::', ''
    
    $permissionEntries = $acl.Access | 
        Where-Object { 
            $_.IdentityReference -like "$env:userdomain*" -or 
            $_.IdentityReference -like "*IIS_IUSRS*" 
        } | Sort-Object IdentityReference | Get-Unique |
        ForEach-Object {
            $inheritanceText = switch ($_.InheritanceFlags) {
                'ContainerInherit, ObjectInherit' { 'This Folder Subfolders And Files' }
                'ContainerInherit' { 'This Folder And Subfolders' }
                'ObjectInherit' { 'This Folder And Files' }
                default { 'This Folder Only' }
            }
            @(
                $_.IdentityReference.Value,
                $_.AccessControlType.ToString(),
                @($_.FileSystemRights.ToString()),
                $inheritanceText,
                'Present'
            )
        }
    
    $ntfsPermissionsHash[$cleanPath] = $permissionEntries
}

# 输出批量处理结果
$ntfsPermissionsHash

内容的提问来源于stack exchange，提问作者QuilleyPowers