Install-Module NTFSSecurity
Import-Module NTFSSecurity

# Check module paths
$env:PSModulePath
 
# Download from PowerShell Gallery then copy to:
# C:\Windows\System32\WindowsPowerShell\v1.0\Modules
 
# Then import
Import-Module NTFSSecurity

# Configuration variables
$group1 = "COMPANY\GRP-Accounting"
$group2 = "COMPANY\GRP-Management"
$targetPath = "D:\Shares\Accounting"
$logPath = "C:\temp\permissions_$(Get-Date -Format 'yyyyMMdd').log"
 
# Function to apply permissions
function Set-FolderPermissions {
    param (
        [string]$Path,
        [string[]]$Groups
    )
    try {
        foreach ($group in $Groups) {
            Add-NTFSAccess -Path $Path -Account $group -AccessRights Modify -AppliesTo ThisFolderSubfoldersAndFiles
            Write-Host "Permissions applied: $group on $Path" -ForegroundColor Green
            "$(Get-Date) - SUCCESS: $group -> $Path" | Out-File -Append $logPath
        }
    } catch {
        Write-Host "Error on $Path : $_" -ForegroundColor Red
        "$(Get-Date) - ERROR: $Path - $_" | Out-File -Append $logPath
    }
}
 
# Recursive application
Write-Host "Starting permission application..." -ForegroundColor Cyan
Get-ChildItem -Recurse -Path $targetPath -Directory | ForEach-Object {
    Set-FolderPermissions -Path $_.FullName -Groups @($group1, $group2)
}
 
Write-Host "Completed! Log available: $logPath" -ForegroundColor Green

# Generate a detailed permissions report
function Get-DetailedPermissionsReport {
    param ([string]$Path)
 
    $report = @()
    Get-ChildItem -Recurse $Path | ForEach-Object {
        $permissions = Get-NTFSAccess -Path $_.FullName
        $owner = Get-NTFSOwner -Path $_.FullName
 
        foreach ($perm in $permissions) {
            $report += [PSCustomObject]@{
                Path = $_.FullName
                Type = if($_.PSIsContainer){"Folder"}else{"File"}
                Owner = $owner.Owner
                Account = $perm.Account
                Rights = $perm.AccessRights
                Inherited = $perm.IsInherited
            }
        }
    }
    return $report
}
 
# Usage
$reportPath = "C:\temp\permissions_audit_$(Get-Date -Format 'yyyyMMdd').csv"
Get-DetailedPermissionsReport -Path "D:\Accounting" | Export-Csv $reportPath -NoTypeInformation
Write-Host "Report generated: $reportPath"

# Find suspicious permissions
function Find-ProblematicPermissions {
    param ([string]$BasePath)
 
    $suspicious = @()
    Get-ChildItem -Recurse $BasePath | ForEach-Object {
        $acl = Get-NTFSAccess -Path $_.FullName
 
        # Find Everyone or Users permissions
        $badPerms = $acl | Where-Object {
            $_.Account -match "Everyone|Users" -and
            $_.AccessRights -match "FullControl|Modify"
        }
 
        if ($badPerms) {
            $suspicious += [PSCustomObject]@{
                Path = $_.FullName
                Account = $badPerms.Account
                Rights = $badPerms.AccessRights
                Risk = "HIGH"
            }
        }
    }
    return $suspicious
}
 
# Usage
Find-ProblematicPermissions -BasePath "D:\Shares" |
    Export-Csv "C:\temp\suspicious_permissions.csv" -NoTypeInformation

# Create a share with team-based permissions
$sharePath = "D:\Shares\Sales-Team"
$groups = @{
    "COMPANY\GRP-Sales" = "Modify"
    "COMPANY\GRP-Management" = "FullControl"
    "COMPANY\GRP-Interns" = "Read"
}
 
# Create folder if it doesn't exist
if (!(Test-Path $sharePath)) { New-Item -Path $sharePath -ItemType Directory }
 
# Apply permissions
foreach ($group in $groups.Keys) {
    Add-NTFSAccess -Path $sharePath -Account $group -AccessRights $groups[$group]
    Write-Host "$group -> $($groups[$group])"
}

# Copy permissions from one folder to another
$sourcePath = "D:\Old\Accounting"
$targetPath = "D:\New\Accounting"
 
# Get source permissions
$sourcePerms = Get-NTFSAccess -Path $sourcePath
 
# Apply to new folder
foreach ($perm in $sourcePerms) {
    if (-not $perm.IsInherited) {  # Ignore inherited permissions
        Add-NTFSAccess -Path $targetPath -Account $perm.Account -AccessRights $perm.AccessRights
        Write-Host "Copied: $($perm.Account) -> $($perm.AccessRights)"
    }
}