共享文件夹与 NTFS 权限

# 查看共享权限（SMB 级别）
Get-SmbShareAccess -Name "Public"

# 查看 NTFS 权限
Get-Acl "E:\Shares\Public" | Select-Object PSPath, Access

# 授予 Domain Admins 完全控制
Grant-SmbShareAccess -Name "Public" -AccountName "IEHANG\Domain Admins" -AccessRight "Full"

# 限制匿名访问
Set-SmbServerConfiguration -RequireSecuritySignature $false -EnableSecuritySignature $true

# 设置 NTFS 权限（授予修改权限）
$acl = Get-Acl "E:\Shares\Public"
$permission = "IEHANG\Domain Users", "Modify", "ContainerInherit,ObjectInherit", "None", "Allow"
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($permission)
$acl.SetAccessRule($rule)
Set-Acl "E:\Shares\Public" $acl

# 使用 icacls 快速设置
icacls "E:\Shares\Public" /grant "IEHANG\Domain Users:(OI)(CI)R"

# 禁用继承，保留现有显式权限
$acl = Get-Acl "E:\Shares\Private"
$acl.SetAccessRuleProtection($true, $true)
Set-Acl "E:\Shares\Private" $acl

# 查看所有 NTFS 权限
Get-Acl "E:\Shares\Public".Access |
    Format-Table IdentityReference, FileSystemRights, IsInherited

# 定义部门列表
$departments = @("财务部", "人事部", "IT信息部", "市场部")

# 创建部门共享文件夹
foreach ($dept in $departments) {
    $path = "E:\Shares\部门共享\$dept"
    if (!(Test-Path $path)) {
        New-Item -Path $path -ItemType "Directory"
        Write-Host "已创建: $path"
    }
}

# 创建公共文件夹
New-Item -Path "E:\Shares\公共文档" -ItemType "Directory" -Force
New-Item -Path "E:\Shares\软件分发" -ItemType "Directory" -Force

# 为财务部配置权限
$path = "E:\Shares\部门共享\财务部"

# 禁用继承并转换为显式权限
$acl = Get-Acl $path
$acl.SetAccessRuleProtection($true, $true)
Set-Acl $path $acl

# 重新获取ACL并移除不需要的权限
$acl = Get-Acl $path
$acl.Access | Where-Object { 
    $_.IdentityReference -notmatch "SYSTEM|Administrators" 
} | ForEach-Object {
    $acl.RemoveAccessRule($_) | Out-Null
}

# 添加财务部组 - 修改权限
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "IEHANG\财务部-G", 
    "Modify", 
    "ContainerInherit,ObjectInherit", 
    "None", 
    "Allow"
)
$acl.AddAccessRule($rule)

# 添加Domain Admins - 完全控制
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "IEHANG\Domain Admins", 
    "FullControl", 
    "ContainerInherit,ObjectInherit", 
    "None", 
    "Allow"
)
$acl.AddAccessRule($rule)

Set-Acl $path $acl
Write-Host "财务部权限配置完成" -ForegroundColor Green

# 创建部门共享（隐藏共享）
New-SmbShare -Name "部门共享$" -Path "E:\Shares\部门共享" -Description "各部门专属文件夹"

# 配置共享权限
Grant-SmbShareAccess -Name "部门共享$" -AccountName "IEHANG\Domain Users" -AccessRight "Read"
Grant-SmbShareAccess -Name "部门共享$" -AccountName "IEHANG\Domain Admins" -AccessRight "Full"

# 创建公共文档共享
New-SmbShare -Name "公共文档" -Path "E:\Shares\公共文档" -Description "全员可读公共资料"
Grant-SmbShareAccess -Name "公共文档" -AccountName "IEHANG\Domain Users" -AccessRight "Read"

# 查看当前ABE状态
Get-SmbShare -Name "部门共享$" | Select-Object Name, FolderEnumerationMode

# 启用ABE（AccessBased = 仅显示有权限的文件夹）
Set-SmbShare -Name "部门共享$" -FolderEnumerationMode "AccessBased"

# 批量启用所有共享的ABE
Get-SmbShare | Where-Object { $_.Name -ne "IPC$" -and $_.Name -ne "ADMIN$" } | ForEach-Object {
    Set-SmbShare -Name $_.Name -FolderEnumerationMode "AccessBased"
    Write-Host "已为 $($_.Name) 启用ABE"
}