Powershell – WMI: Working with Shares – Part 1: Creating a Share with Custom Permissions

Great to hear that someone is using my script 😉

and thanks alot for the bug fix! 🙂

Nice work!!
I added support for setting permissions for Everyone and Authenticated users. Also Updated the New-Share function to address the bug James found.

# //************************************************************************************************************
# // ***** Script Header *****
# //
# // Solution: Coretech Share Functions
# // File: NewShareWithPermission.ps1
# // Author: Jakob Gottlieb Svendsen, Coretech A/S. http://blog.coretech.dk
# // Purpose:
# // New-Share: Creates new Share on local or remote PC, with custom permissions.
# // Required Parameters: FolderPath, ShareName
# //
# // New-ACE: Creates ACE Objects, for use when running New-Share.
# // Required Parameters: Name, Domain
# //
# // New-SecurityDescriptor: used by New-Share to prepare the permissions.
# // Required Parameters: ACEs
#//
# // Usage Examples:
# // New-Share -FolderPath “C:Temp” -ShareName “Temp” -ACEs $ACE,$ACE2 -Description “Test Description” -Computer “localhost”
# // Sharing of folder C:Temp, with the Name “Temp”. ACE’s (Permissions) are sent via the -ACEs parameter.
# // Create them with New-ACE and send one or more, seperated by comma (or create and array and use that)
# //
# // This is the first in a couple of share-administration scripts i am planning to make and release on the blog.
# //
# // Please comment the blog post, if you have any suggestions, questions or feedback.
# // Contact me if you need us to make a custom script (or cause not for free )
# //
# // CORETECH A/S History:
# // 0.0.1 JGS 30/06/2009 Created initial version.
# //
# // Customer History:
# // 0.0.2 – Jonathan Warnken([email protected]) 16/12/2009
# // – Added logic to all permissions to be set using Everyone and Authenticated Users. These use well known SIDs and are easier to hard code then lookup.
# // – Usage Examples:
# // – (Everyone) $ACE = New-ACE -Name “Everyone” -Domain “.” -Permission “Read” -Group
# // – (Authenticated Users) $ACE = New-ACE -Name “Authenticated Users” -Domain “NT AUTHORITY” -Permission “Read” -Group
# // –
# // – Updated New-Share so that -MaxUsers and -Password are optional parameters. The default values are $null.
# // – Updated the Main Code examples to use an Array for the Access Control objects
# //
# // ***** End Header *****
# //**************************************************************************************************************
#//—————————————————————————-
#// Procedures
#//—————————————————————————-

Function New-SecurityDescriptor (
$ACEs = (throw “Missing one or more Trustees”),
[string] $ComputerName = “.”)
{
#Create SeCDesc object
$SecDesc = ([WMIClass] “\$ComputerNamerootcimv2:Win32_SecurityDescriptor”).CreateInstance()
#Check if input is an array or not.
if ($ACEs -is [System.Array])
{
#Add Each ACE from the ACE array
foreach ($ACE in $ACEs )
{
$SecDesc.DACL += $ACE.psobject.baseobject
}
}
else
{
#Add the ACE
$SecDesc.DACL = $ACEs
}
#Return the security Descriptor
return $SecDesc
}

Function New-ACE (
[string] $Name = (throw “Please provide user/group name for trustee”),
[string] $Domain = (throw “Please provide Domain name for trustee”),
[string] $Permission = “Read”,
[string] $ComputerName = “.”,
[switch] $Group = $false)
{
#Create the Trusteee Object
$Trustee = ([WMIClass] “\$ComputerNamerootcimv2:Win32_Trustee”).CreateInstance()
#Check for Special cases Everyone and Authenticated Users)
switch ($Name.ToUpper()) {
“EVERYONE” {
$Trustee.Domain = $Null
$Trustee.Name = “EVERYONE”
$Trustee.SID = @(1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0)
}
“AUTHENTICATED USERS” {
$Trustee.Domain = “NT AUTHORITY”
$Trustee.Name = “Authenticated Users”
$Trustee.SID = @(1, 1, 0, 0, 0, 0, 0, 5, 11, 0, 0, 0)
}
default {
#Search for the user or group, depending on the -Group switch
if (!$group)
{ $account = [WMI] “\$ComputerNamerootcimv2:Win32_Account.Name=’$Name’,Domain=’$Domain'” }
else
{ $account = [WMI] “\$ComputerNamerootcimv2:Win32_Group.Name=’$Name’,Domain=’$Domain'” }
#Get the SID for the found account.
$accountSID = [WMI] “\$ComputerNamerootcimv2:Win32_SID.SID=’$($account.sid)'”
#Setup Trusteee object
$Trustee.Domain = $Domain
$Trustee.Name = $Name
$Trustee.SID = $accountSID.BinaryRepresentation
}
}
#Create ACE (Access Control List) object.
$ACE = ([WMIClass] “\$ComputerNamerootcimv2:Win32_ACE”).CreateInstance()
#Select the AccessMask depending on the -Permission parameter
switch ($Permission)
{
“Read” { $ACE.AccessMask = 1179817 }
“Change” { $ACE.AccessMask = 1245631 }
“Full” { $ACE.AccessMask = 2032127 }
default { throw “$Permission is not a supported permission value. Possible values are ‘Read’,’Change’,’Full'” }
}
#Setup the rest of the ACE.
$ACE.AceFlags = 3
$ACE.AceType = 0
$ACE.Trustee = $Trustee
#Return the ACE
return $ACE
}

Function New-Share (
[string] $FolderPath = (throw “Please provide the share folder path (FolderPath)”),
[string] $ShareName = (throw “Please provide the Share Name”),
$ACEs,
[string] $Description = “”,
[string] $ComputerName = “.”,
$MaxUsers = $null,
$Password = $null)
{
#Start the Text for the message.
$text = “$ShareName ($FolderPath): ”
#Package the SecurityDescriptor via the New-SecurityDescriptor Function.
$SecDesc = New-SecurityDescriptor $ACEs
#Create the share via WMI, get the return code and create the return message.
$Share = [WMICLASS] “\$ComputerNameRootCimv2:Win32_Share”
$result = $Share.Create($FolderPath, $ShareName, 0, $MaxUsers, $Description, $Password, $SecDesc)
switch ($result.ReturnValue)
{
0 {$text += “has been success fully created” }
2 {$text += “Error 2: Access Denied” }
8 {$text += “Error 8: Unknown Failure” }
9 {$text += “Error 9: Invalid Name”}
10 {$text += “Error 10: Invalid Level” }
21 {$text += “Error 21: Invalid Parameter” }
22 {$text += “Error 22 : Duplicate Share”}
23 {$text += “Error 23: Redirected Path” }
24 {$text += “Error 24: Unknown Device or Directory” }
25 {$text += “Error 25: Net Name Not Found” }
}
#Create Custom return object and Add results
$return = New-Object System.Object
$return | Add-Member -type NoteProperty -name ReturnCode -value $result.ReturnValue
$return | Add-Member -type NoteProperty -name Message -value $text
#Return result object
$return
}

#//—————————————————————————-
#// Main routines
#//—————————————————————————-

#Create ACE’s for the securitydescriptor for the share:
#a group ACE, containing Group info, please notice the -Group switch
$ACE = @(New-ACE -Name “Domain Users” -Domain “CORETECH” -Permission “Read” -Group)
$ACE += New-ACE -Name “Authenticated Users” -Domain “NT AUTHORITY” -Permission “Read” -Group
$ACE += New-ACE -Name “everyone” -Domain “.” -Permission “Read” -Group
#a user ACE.
$ACE += New-ACE -Name “CCO” -Domain “CORETECH” -Permission “Full”

#Create the share on the local machine
$result = New-Share -FolderPath “C:Temp” -ShareName “Temp4” -ACEs $ACE -Description “Test Description” -Computer “localhost”

#Output result message from new-share
Write-Output $result.Message

#Check if the share was succesfully created
If ($result.ReturnCode -eq 0)
{
#Creation was succesfull, put your next code here.
}

#//—————————————————————————-
#// End Script
#//—————————————————————————-

Thank you so much for this script. It saved me a lot of time.

Hello

Yes sometimes the browsers change the chars.

use the download link in the top of the page to download a zip file containing the script 🙂

Best Regards
Jakob

Hello eric!

Nice to know it is working for you!

I don’t see any reason it shouldnt work in Win XP PRo 64bit. but I have not tested it myself, if it does not work, please post your feedback/problems 🙂

Best regards
Jakob

Hello Eric

i cannot see anything wrong in your syntax, i could be wrong tho.

It is really hard, next to impossible to help you, when you have not included the error message you are getting.

unfortunately there is no new version in development at the moment, i have too many other projects that need my work at the moment.

Best regards
Jakob

Hello again!

I’ve found the solution and maybe you can explain me. The computername in function New-Ace hast to be “.” Why?

regards

I used the scripts to successfully create a share on a remote server using a local group from that remove servers. To do so, I specified the domain name as the server name.

This was on a win2008 r2 box.

Cannot convert value “\.rootcimv2:Win32_Group.Name=’Administrators’,Domain=’Domain'” to type “System.
Management.ManagementObject”. Error: “Not found ”
At C:SupportNew-APPS-Share.PS1:75 char:19
+ { $account = [WMI] <<<< "\$ComputerNamerootcimv2:Win32_Group.Name='$Name',Domain='$Domain'" }
+ CategoryInfo : NotSpecified: (:) [], RuntimeException
+ FullyQualifiedErrorId : RuntimeException

We are running Server 2008 R2, i am logged in as administrator running Power Shell as administrator.

i am trying to add the Administrators Group to a share.

#Create ACE’s for the securitydescriptor for the share:
#a group ACE, containing Group info, please notice the -Group switch
$ACE = New-ACE -Name “Administrator” -Domain “My.domain” -Permission “Full”
#a user ACE.
$ACE2 = New-ACE -Name “Administrators” -Domain “My.domain” -Permission “Full” -Group

Thanks for the Fast Responce

Hi Jakob,

Thanks for your great script.
Who can i set the Cache to “No files or programs from the shared folder are available offline’?

Thanks in advance,

Regards,
Verdural

Works fine, but does not work for hidden shares, how to create hidden shares like admin$.