ACL rights assignment in new user script

Question

I've been tasked with converting an old new-user script that runs at least once a day written in VB to PowerShell. This script takes as input a CSV file we get from HR that has all necessary info and creates a user, adds them to specific groups based on
the info in the CSV, enables their Exchange mailbox, and creates their home directory. I'm having a bit of trouble planning out the rights assignment part on the user home directory; I need to be able to add the specific user (set by variable at the beginning
of the script) and three static groups. What is the best way to do that? I can easily grab outside modules if needed (a section of my script checks for and if necessary installs modules and adds snap-ins), but I'd rather keep this 100% PowerShell - no icacls
or outside commands.
Any suggestions?
Thank you in advance.
[email protected]

Answer 1

Here's what I came up with for the File System Stuff:
foreach ($user in $userlist)
$samaccountname = $user.empid
$FQN = "domain\" + $samaccountname
$homedirpath = "\\fileserver\users\$samaccountname"
new-item -ItemType directory -path $homedirpath -force
#Set ACLs for user and required groups
$homedir_acl = get-acl $homedirpath
$acl_access1 = 'domain\HomeDirectory Admins'
$acl_access2 = "domain\$samaccountname"
$fullrights = "Fullcontrol"
$modifyrights = "Modify"
$inheritrights = "ContainerInherit,ObjectInherit"
$rule1 = new-object system.security.accesscontrol.filesystemaccessrule ($acl_access1, $fullrights, $inheritrights, "none", "Allow")
$rule2 = new-object system.security.accesscontrol.filesystemaccessrule ($acl_access2, $modifyrights, $inheritrights, "none", "Allow")
$homedir_acl.addAccessRule($rule1)
set-acl $homedirpath $homedir_acl
$homedir_acl.addAccessRule($rule2)
set-acl $homedirpath $homedir_acl
#Set owner on home directory
$owner = New-Object System.Security.Principal.NTAccount($FQN)
$homedir_acl.setowner($owner)
set-acl $homedirpath $homedir_acl
[email protected]