Enumerate the users that have access to a particular directory

Question

Hi, my name is Jennifer and I have been searching for an answer to my problem through several blogs. The problem is that I have a Directory of which I want to not only retrieve the users\groups that have access to it but also enumerate through the groups
to list actual users. The groups part is the main issue here. If I use get-acl, I can return any number of particular Active Directory groups that have access, however, I need to list the users inside this group and get-acl will not output an object I can
work with. I thought I could do something like this (which I may have seen on this forum before):
get-acl "C:\NestedGroupTest" | %{$_.access} \ ft -property identityreference
This will return the groups\users that have access. Example:
Domain\OU
NT Authority\system
Builtin\users
ETC...
I have tried exporting this output to a file and then trying to use get-adgroupmember (which obviously will not work on the non-AD groups) but the objects are of the wrong type so basically nothing in the Active Directory module will work...
This seems like such a simple issue but it is causing me grief to no end...please help

Answer 1

I can't guarantee that this will work in all cases, but it seems to work on my test domain. Warning: it's very slow and inefficient. It requires
this module (get the 3.0 test version), but you can modify the foreach block's code somewhat to get it to work with Get-Acl. 
Get-Item C:\NestedGroupTest | Get-AccessControlEntry | ForEach-Object { $PropertyNames = $null }{
if (-not $PropertyNames) {
# We need to copy the property. This will get a list
# of the properties on each ACE when it encounters
# the first ACE (since the rest of this is so ineffecient,
# we can feel good that we saved some work by doing this)
$PropertyNames = $_ | Get-Member -MemberType Properties | select -exp Name
# Create a new hashtable that will be used to create a PSObject
$NewObjectProps = @{}
foreach ($CurrentProperty in $PropertyNames) {
$NewObjectProps.$CurrentProperty = $_.$CurrentProperty
# Check to see if this SID belongs to an AD group
Write-Verbose ("Current principal: {0}" -f $_.Principal)
try {
$Group = Get-ADGroup -Filter { SID -eq $_.SecurityIdentifier } -ErrorAction Stop
catch {
# Write a warning or something?
if ($Group) {
Write-Verbose " -> Group, so looking up members"
$Users = $Group | Get-ADGroupMember -Recursive | select @{N="Principal"; E={$_.SID.Translate([System.Security.Principal.NTAccount])}}, @{N="SecurityIdentifier"; E={$_.SID}}
else {
Write-Verbose " -> Not an AD group"
$Users = $_ | select Principal, SecurityIdentifier
# Go through each user/non-translated group, modify two
# hashtable properties, and create the new PSObject
$Users | ForEach-Object {
$NewObjectProps.SecurityIdentifier = $_.SecurityIdentifier
$NewObjectProps.Principal = $_.Principal
$NewObject = New-Object PSObject -Property $NewObjectProps
# This will make the new object show the module's custom formatting:
$NewObject.pstypenames.Insert(0, "PowerShellAccessControl.Types.AdaptedAce")
$NewObject
That should resemble the output that Get-AccessControlEntry would give you, but AD groups have been translated to users. If you pipe that to Export-CSV, you'd have plenty of information for each ACE, including the path, principal, security identifier, access
mask, etc. You could also pipe that to Select-Object and just ask for certain properties (try it with these properties: Path, Principal, AccessMask, AccessMaskDisplay, AppliesTo).
You can also use the Get-AccessControlEntry function's parameters to do some filtering on the ACEs that are returned (maybe you only want ACEs with FullControl, or ACEs that were not inherited...)
Give it a shot and let me know if it works for you. If you need more explanation of what's going on in the foreach-object process block, let me know and I'll try to help. It can be modified to work with version 2.1 of my module, and with Get-Acl.