I’ve got this function working to add a standard share permission (read, change or full control) to a share
#requires -Version 3.0
function Add-SharePermission {
[CmdletBinding()]
param (
[Parameter(Mandatory=$true)]
[string]$sharename,
[string]$domain = $env:COMPUTERNAME,
[Parameter(Mandatory=$true)]
[string]$trusteeName,
[Parameter(Mandatory=$true)]
[ValidateSet("Read", "Change", "FullControl")]
[string]$permission = “Read”,
[string]$computername = $env:COMPUTERNAME
)
switch ($permission) {
‘Read’ {$accessmask = 1179817}
‘Change’ {$accessmask = 1245631}
‘FullControl’ {$accessmask = 2032127}
}
$tclass = [wmiclass]“\\$computername\root\cimv2:Win32_Trustee”
$trustee = $tclass.CreateInstance()
$trustee.Domain = $domain
$trustee.Name = $trusteeName
$aclass = [wmiclass]“\\$computername\root\cimv2:Win32_ACE”
$ace = $aclass.CreateInstance()
$ace.AccessMask = $accessmask
$ace.AceFlags = 0
$ace.AceType = 0
$ace.Trustee = $trustee
$shss = Get-WmiObject -Class Win32_LogicalShareSecuritySetting -Filter “Name=’$sharename’” -ComputerName $computername
$sd = Invoke-WmiMethod -InputObject $shss -Name GetSecurityDescriptor |
select -ExpandProperty Descriptor
$sclass = [wmiclass]“\\$computername\root\cimv2:Win32_SecurityDescriptor”
$newsd = $sclass.CreateInstance()
$newsd.ControlFlags = $sd.ControlFlags
foreach ($oace in $sd.DACL){$newsd.DACL += $oace}
$newsd.DACL += $ace
$share = Get-WmiObject -Class Win32_LogicalShareSecuritySetting -Filter “Name=’$sharename’”
$share.SetSecurityDescriptor($newsd)
} # end function
I needed to drop back to the WMI cmdlets to make it work. The reason you can’t create a Win32_ACE instance with New-CimInstance is that the class doesn’t appear to have a key which the cmdlet expects.
Have a look at the function. Its late where I am. I’ll put up a blog post explaining the function tomorrow and provide a link.
Hope this helps