Bered

Remove Unknown SIDs From NTFS Folder That Have Inheritance Disabled

Jan 18th, 2021 (edited)
1,070
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ######################################
  2.  
  3. #Author = Bered
  4. #Created 19/01/2021
  5. #Name = Remove Unknown SIDs
  6. #Purpose - Find and remove and unknown SIDs (S-1-5-*) from a specific folder and subfolder.
  7.  
  8. ######################################
  9.  
  10. $Folders = Get-ChildItem '#>FILE PATH HERE<#' -Recurse
  11. foreach($Folder in $folders)
  12.     {
  13.     $Path = $folder.FullName
  14.     $ACLSearch = Get-Acl -Path $Path
  15.     foreach($ACL in $ACLSearch)
  16.         {
  17.         IF ( $ACL.Access.IsInherited -eq $false -and $ACL.Access.IdentityReference -like "S-1-5-*")
  18.             {
  19.             Write-Host $Path
  20.             $Rule = $ACL.Access | ?{ $_.IsInherited -eq $false -and $_.IdentityReference -like "S-1-5-*"}
  21.             Foreach ($SubRule in $Rule)
  22.                 {
  23.                 $acl.RemoveAccessRule($Subrule) | Out-Null
  24.                 Set-Acl -Path $Path -AclObject $ACL | Out-Null
  25.                  }            
  26.             }
  27.         }
  28.     }
  29.  
RAW Paste Data