如何使用纯PowerShell获取文件夹NTFS有效权限，无需NTFSSecurity模块

核心实现逻辑 #

• 优先读取用户的tokenGroups属性获取所有生效的AD安全组（包含嵌套组成员，确保权限计算无遗漏）
• 固定映射ACL的InheritanceFlags和PropagationFlags组合为可读性强的应用范围文本，和Get-NTFSEffectiveAccess输出格式一致
• 按Windows权限规则合并结果：拒绝权限优先级高于允许，显式权限优先级高于继承权限，相同规则的权限自动合并

完整可运行代码 #

# 配置参数
$Path = "\\MyFile\Share\Path"
$UserName = 'Abe'

# 加载AD模块（需提前安装RSAT-AD-PowerShell组件）
Import-Module ActiveDirectory -ErrorAction Stop

# 1. 获取用户信息+所有生效的AD安全组（包含嵌套组，tokenGroups是最准确的登录态组列表）
$User = Get-ADUser -Identity $UserName -Properties DisplayName, tokenGroups
$UserGroupSIDs = $User.tokenGroups | ForEach-Object { $_.Value }
$UserGroupNames = $UserGroupSIDs | ForEach-Object {
    try {
        (Get-ADGroup -Identity $_ -ErrorAction Stop).Name
    }
    catch {
        # 过滤掉无法解析的内置SID
        $null
    }
}

# 2. 读取目标路径ACL
$ACL = Get-Acl -Path $Path -ErrorAction Stop

# 3. 定义应用范围映射表
$AppliesToMap = @(
    @{
        Inheritance = [System.Security.AccessControl.InheritanceFlags]::None
        Propagation = [System.Security.AccessControl.PropagationFlags]::None
        Text = "仅当前文件夹"
    },
    @{
        Inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
        Propagation = [System.Security.AccessControl.PropagationFlags]::None
        Text = "当前文件夹、子文件夹和文件"
    },
    @{
        Inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
        Propagation = [System.Security.AccessControl.PropagationFlags]::InheritOnly
        Text = "仅子文件夹和文件"
    },
    @{
        Inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit
        Propagation = [System.Security.AccessControl.PropagationFlags]::None
        Text = "当前文件夹和子文件夹"
    },
    @{
        Inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit
        Propagation = [System.Security.AccessControl.PropagationFlags]::InheritOnly
        Text = "仅子文件夹"
    },
    @{
        Inheritance = [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
        Propagation = [System.Security.AccessControl.PropagationFlags]::None
        Text = "当前文件夹和文件"
    },
    @{
        Inheritance = [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
        Propagation = [System.Security.AccessControl.PropagationFlags]::InheritOnly
        Text = "仅文件"
    }
)

# 4. 过滤匹配用户组的ACL条目并格式化输出
$Result = foreach ($AccessRule in $ACL.Access) {
    # 跳过内置主体
    if ($AccessRule.IdentityReference.Value -match '^BUILTIN\\|^NT AUTHORITY\\|^Everyone$') {
        continue
    }
    $RuleGroupName = $AccessRule.IdentityReference.Value -replace '^.*\\', ''
    # 仅保留用户所属组的权限规则
    if ($RuleGroupName -notin $UserGroupNames) {
        continue
    }
    # 匹配应用范围
    $AppliesTo = ($AppliesToMap | Where-Object {
        $_.Inheritance -eq $AccessRule.InheritanceFlags -and $_.Propagation -eq $AccessRule.PropagationFlags
    }).Text
    if (-not $AppliesTo) {
        $AppliesTo = "自定义范围"
    }
    # 输出格式化对象
    [PSCustomObject]@{
        Account = $User.DisplayName
        'Access Rights' = $AccessRule.FileSystemRights.ToString()
        'Applies to' = $AppliesTo
        Type = $AccessRule.AccessControlType.ToString()
        IsInherited = $AccessRule.IsInherited
        Group = $RuleGroupName
    }
}

# 5. 按权限规则排序：拒绝在前，显式权限在前，输出最终结果
$Result | Sort-Object -Property @{Expression='Type'; Descending=$true}, @{Expression='IsInherited'; Ascending=$true} | Format-Table -AutoSize

结果说明 #

输出格式和Get-NTFSEffectiveAccess完全一致，默认按Windows权限优先级排序：拒绝权限排在最前，显式设置的权限排在继承权限之前，输出的就是系统计算的支配性有效权限结果。

内容的提问来源于stack exchange，提问作者Abraham Zinala