1
Import-Module ActiveDirectory
2
$domain = Get-ADDomain
3
if ($domain.DNSRoot -ne 'qy.net') { throw '当前连接的不是 qy.net。' }
4

5
$labOU = "OU=SharePermissions,$($domain.DistinguishedName)"
6
$userOU = "OU=User,$labOU"
7
$groupOU = "OU=Group,$labOU"
8
$groupNames = @(
9
    'GG_LabShare_Read'
10
    'GG_LabShare_Modify'
11
    'DL_LabShare_Read'
12
    'DL_LabShare_Modify'
13
)
14
$userNames = @('lab_share_ro','lab_share_rw','lab_share_no')
15

16
# 重名就停止，不覆盖未知的既有对象
17
if (Get-ADOrganizationalUnit -Filter 'Name -eq "SharePermissions"') {
18
    throw '同名 OU 已存在，请先确认。'
19
}
20
foreach ($name in ($groupNames + $userNames)) {
21
    if (Get-ADObject -Filter { sAMAccountName -eq $name }) {
22
        throw "账户名已存在：$name"
23
    }
24
}
25

26
New-ADOrganizationalUnit -Name 'SharePermissions' -Path $domain.DistinguishedName
27
New-ADOrganizationalUnit -Name 'User' -Path $labOU
28
New-ADOrganizationalUnit -Name 'Group' -Path $labOU
29

30
foreach ($name in $groupNames) {
31
    $scope = if ($name -like 'GG_*') { 'Global' } else { 'DomainLocal' }
32
    New-ADGroup -Name $name -SamAccountName $name -GroupScope $scope -GroupCategory Security -Path $groupOU
33
}
34

35
foreach ($name in $userNames) {
36
    # 安全输入，不把明文密码写进笔记
37
    $password = Read-Host "为 $name 输入实验密码" -AsSecureString
38
    $userParams = @{
39
        Name = $name
40
        SamAccountName = $name
41
        UserPrincipalName = "$name@$($domain.DNSRoot)"
42
        Path = $userOU
43
        AccountPassword = $password
44
        Enabled = $true
45
        ChangePasswordAtLogon = $false
46
    }
47
    New-ADUser @userParams
48
}
49

50
# 用户 → 全局组 → 域本地组
51
Add-ADGroupMember -Identity GG_LabShare_Read -Members lab_share_ro
52
Add-ADGroupMember -Identity GG_LabShare_Modify -Members lab_share_rw
53
Add-ADGroupMember -Identity DL_LabShare_Read -Members GG_LabShare_Read
54
Add-ADGroupMember -Identity DL_LabShare_Modify -Members GG_LabShare_Modify
55

56
Get-ADGroup -Filter * -SearchBase $labOU |
57
    Select-Object Name,GroupScope,GroupCategory
58

59
# 不递归：看直接成员，确认嵌套方向
60
Get-ADGroupMember -Identity DL_LabShare_Read |
61
    Select-Object Name,ObjectClass
62

63
# 递归：看展开后的成员，不能靠它还原完整嵌套路径
64
Get-ADGroupMember -Identity DL_LabShare_Read -Recursive |
65
    Select-Object Name,SamAccountName,ObjectClass

1
$computer = Get-CimInstance Win32_ComputerSystem
2
if ($computer.Domain -ne 'qy.net' -or $computer.DomainRole -ge 4) {
3
    throw '应在 qy.net 的成员服务器执行，不在域控执行。'
4
}
5
$labPath = 'C:\ADLab\SharePermissions\Data'
6
if (-not (Test-Path -LiteralPath $labPath -PathType Container)) {
7
    throw '先完成实验目录创建。'
8
}
9

10
# 创建明确的 DACL，一次应用，保留管理员与系统的维护授权
11
$acl = [System.Security.AccessControl.DirectorySecurity]::new()
12
$acl.SetAccessRuleProtection($true, $false)
13
$entries = @(
14
    @{Identity = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-18'); Rights = 'FullControl'}
15
    @{Identity = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'); Rights = 'FullControl'}
16
    @{Identity = [System.Security.Principal.NTAccount]::new('qy\DL_LabShare_Read'); Rights = 'ReadAndExecute'}
17
    @{Identity = [System.Security.Principal.NTAccount]::new('qy\DL_LabShare_Modify'); Rights = 'Modify'}
18
)
19
foreach ($entry in $entries) {
20
    $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
21
        $entry.Identity,
22
        [System.Security.AccessControl.FileSystemRights]$entry.Rights,
23
        [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',
24
        [System.Security.AccessControl.PropagationFlags]::None,
25
        [System.Security.AccessControl.AccessControlType]::Allow
26
    )
27
    $acl.AddAccessRule($rule)
28
}
29
Set-Acl -LiteralPath $labPath -AclObject $acl
30

31
(Get-Acl -LiteralPath $labPath).Access |
32
    Select-Object IdentityReference,FileSystemRights,AccessControlType,IsInherited
33
(Get-Acl -LiteralPath (Join-Path $labPath 'readme.txt')).Access |
34
    Select-Object IdentityReference,FileSystemRights,AccessControlType,IsInherited

1
# FS01 管理员窗口；NTFS 权限应已配置好
2
$shareParams = @{
3
    Name = 'LabShare'
4
    Path = 'C:\ADLab\SharePermissions\Data'
5
    ReadAccess = 'qy\DL_LabShare_Read'
6
    ChangeAccess = 'qy\DL_LabShare_Modify'
7
    FullAccess = 'qy\Domain Admins'
8
    CachingMode = 'None'
9
}
10
New-SmbShare @shareParams
11

12
Get-SmbShare -Name LabShare |
13
    Select-Object Name,Path,CachingMode
14
Get-SmbShareAccess -Name LabShare |
15
    Select-Object AccountName,AccessControlType,AccessRight