0

I need to set the share permissions of a remote share from a Powershell 4 script. I've looked at this page, specifically the command Grant-SmbShareAccess but that cmdlet sets permissions on local shares, I would love to have seen a -ComputerName parameter but, alas, there isn't one.

I want to do something like: Grant-SmbShareAccess -ComputerName MYREMOTESERVER -Name <share_name> -AccountName <domain_account> -AccessRight Full

Any ideas on how to do this? My remote server could be a Windows Server or a NetApp vFiler.

EDIT

I tried Matt's suggestion of Invoke-Command in the comments against a NetApp vFiler and got this error:

Connecting to remote server MYREMOTESERVER failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig".

Changing the security of the share in Windows Explorer works fine.

4
  • Perhaps Invoke-Command is what you are looking for. More information here
    – Matt
    Sep 4, 2014 at 12:07
  • @Matt If I was only dealing with remote windows servers, I would look at that, but if the remote share is hosted on a NetApp vFiler, I don't think it's going to work because it depends on remoting. Sep 4, 2014 at 12:15
  • Have you tried to just pass the server name along with the share name? Something like: Grant-SmbShareAccess -Name \\MYREMOTESERVER\SHARENAME -AccountName USERACCOUNT -AccessRight Full
    – CitizenRon
    Sep 4, 2014 at 21:27
  • @CitizenRon Thanks for the suggestion but that doesn't work either because the command is looking for a local share. I tried it anyway: Grant-SmbShareAccess : No MSFT_SMBShare objects found with property 'Name' equal to '\\MYREMOTESERVER\SHARENAME'. Verify the value of the property and retry. Sep 5, 2014 at 8:28

3 Answers 3

0

Grant-SmbShareAccess is a CDXML command, which means that it uses CIM. As you've already noticed, it should only work on a Windows system running at least PSv3 (in this case the WMI class used only exists on Windows 8 and Server 2012 or higher).

There may be other ways to do this against a non-Windows server, but I would try the PowerShell Access Control Module:

$SharePath = "\\ServerName\ShareName"
$Principal = <account name here>

# Add permission to $Principal (-Force will suppress the prompt)
Get-SecurityDescriptor -Path $SharePath -ObjectType LMShare |
    Add-AccessControlEntry -Principal $Principal -LogicalShareRights FullControl -Apply #-Force

# Verify:
Get-SecurityDescriptor -Path $SharePath -ObjectType LMShare |
    Get-AccessControlEntry

I honestly don't know if this will work since I've only tested it against Windows servers and I don't deal with share permissions very often. Try it out, and if it works, I'll take this part out of the answer.

2
  • Thanks, is there any way without using that module? I'm trying to do this using the default set of tools on a Windows Server. Sep 9, 2014 at 11:23
  • Maybe, but I don't know of one. Does the module work? If so, I can modify the answer to include a much shorter PowerShell script that just includes the P/Invoke signatures and PS/.NET code needed to get it working (no module needed). Sep 9, 2014 at 16:50
0

For Windows Server SMB shares, use the -CimSession parameter.

For non-Windows SMB shares, I would not expect the Windows SMB administration cmdlets to work with them.

0

The Netapp Powershell toolkit will help with this. Once installed you can import the module into your script, and manage your shares. Here is a rough example that connects to a filer, prompts for a sharename, then configures that share with some default permissions:

# Import the Netapp Powershell Module
import-module dataontap

# Connect to the filer
connect-nacontroller *filername*

# Get the sharename
$sharename = Read-Host -Prompt 'Enter the share you want to configure'

# Configure the CIFS Permissions
Set-NaCifsShareAcl $sharename "Authenticated users" -AccessRights "Change"
Set-NaCifsShareAcl $sharename filername\administrators -AccessRights "Full Control"
Set-NaCifsShareAcl $sharename domain\somegroup -AccessRights "Full Control"
Remove-NaCifsShareAcl $sharename everyone

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.