NTFSSecurity PowerShell Module

When using the PathComplex or SDComplex parameter sets, you can fine-tune how auditing is passed down to child objects:

InheritanceFlags

• ObjectInherit: Applies auditing to files and folders within the defined path.
• ContainerInherit: Applies auditing to subfolders, but not to files.
• None: No inheritance flags are set.

PropagationFlags

• Inherit: Auditing is propagated to child objects (both folders and files).
• NoPropagateInherit: Auditing is not propagated to child objects.
• None: No propagation flags are set.

The Add-NTFSAudit cmdlet supports four different parameter sets depending on whether you are targeting a file path or a security descriptor, and how much control you need over inheritance and propagation:

1. PathComplex (Default): Used for full control over inheritance and propagation when providing a file path.
2. PathSimple: A simplified version for paths using the -AppliesTo parameter instead of complex inheritance flags.
3. SDSimple: Used when providing a security descriptor, using -AppliesTo for scope.
4. SDComplex: Used when providing a security descriptor with full control over inheritance and propagation flags.

The Get-NTFSEffectiveAccess cmdlet operates using two distinct parameter sets. You must choose one based on your available data:

1. Path Parameter Set: Used when you have a file system path.

   • Requires: -Path (optional, but defines the set).
   • Can include: -Account, -ServerName, -ExcludeNoneAccessEntries.

2. SecurityDescriptor Parameter Set: Used when you already have security descriptor objects in memory.

   • Requires: -SecurityDescriptor (must be provided).
   • Can include: -Account, -ServerName, -ExcludeNoneAccessEntries.

NTFSSecurity handles permissions using two distinct models:

1. Basic Permissions: These are predefined groups of advanced permissions that represent common roles, such as Read, Read/Write, or Full. Use these for standard access requirements.
2. Advanced Permissions: These provide granular control over specific actions (e.g., WriteAttributes, DeleteSubdirectoriesAndFiles). These are essential for building custom Role-Based Access Control (RBAC) tooling where specific, fine-grained restrictions are required.

When using the module, you will often map high-level requirements to these specific advanced permission tokens.

The -AuditFlags parameter determines which access attempts are recorded in the security log.

• Use Failure to audit only denied access attempts.
• Use Success to audit all successful access attempts.
• Use None to set no specific audit flags.

You can install the NTFSSecurity module using two methods:

1. PowerShell Gallery: Use the Install-Module command to download and install the module directly.
2. GitHub Releases: Download the latest release manually from the GitHub releases page.

NTFSSecurity is designed to bridge the gap in native PowerShell capabilities (like Get-Acl and Set-Acl) by providing cmdlets for common day-to-day tasks such as generating permission reports and adding/removing permissions from files and folders.

Install-Module -Name NTFSSecurity

Orphaned permissions occur when an account is no longer available (e.g., deleted), causing the permission to appear as a SID rather than an account name.

1. Use Get-NTFSOrphanedAccess to list these non-resolvable permissions.
2. Use Remove-NTFSAccess to delete them.

Warning: Use caution when removing orphaned permissions via recursion, as network connectivity issues can sometimes prevent SIDs from resolving, making valid accounts appear orphaned.

# List and remove all non-resolvable/orphaned permissions recursively
dir -Recurse | Get-NTFSOrphanedAccess | Remove-NTFSAccess

Because the module's cmdlets may not be fully documented via the native Get-Help command, you should refer to external resources for complete guidance:

• Official Documentation: The primary documentation is hosted on ReadTheDocs.
• Author Tutorials:
  • Tutorial 1: Getting, adding and removing permissions
  • Tutorial 2: Managing NTFS Inheritance and Using Privileges

You can use the PowerShell pipeline to backup and restore permissions for one or many items. To backup, pipe the output of Get-NTFSAccess (ideally with -ExcludeInherited) to Export-Csv. To restore, pipe the imported CSV data back into Get-NTFSAccess. Because the exported data includes the file path, you do not need to specify a path when restoring.

# Backup permissions to a CSV file
dir | Get-NTFSAccess -ExcludeInherited | Export-Csv permissions.csv

# Restore permissions from the CSV file
Import-Csv .\permissions.csv | Get-NTFSAccess

Use the Clear-NTFSAudit cmdlet to remove System Access Control Lists (SACLs) from files or directories. This effectively clears the auditing configuration for the specified objects. You can target objects by providing a list of file paths or by passing an array of FileSystemSecurity2 objects.

Note that clearing the SACL removes the instructions that define what type of auditing events (such as access attempts) should be recorded for that object.

Clear-NTFSAudit -Path "C:\path\to\folder", "C:\path\to\file.txt"

Use the Add-NTFSAudit cmdlet to apply audit policies to individual files and folders. This allows you to record successful or failed access attempts in the security log.

Prerequisites: To use this cmdlet, you must be signed in as a member of the built-in Administrators group or have Manage auditing and security log rights.

Add-NTFSAudit -Path C:\Data -Account 'NT AUTHORITY\Authenticated Users' -AccessRights GenericAll -AuditFlags Failure