Find shares with PowerShell where Everyone has Full Control permissions

• Author
• Recent Posts

Sitaram Pamarthi

Sitaram Pamarthi is working as a Windows Engineer and his special fields of interest are PowerShell, Active Directory, Exchange, and virtualization.

Latest posts by Sitaram Pamarthi (see all)

• Add a domain user or group to local administrators with PowerShell - Wed, Mar 19 2014
• Create a list of local administrators with PowerShell - Wed, Mar 5 2014
• Remotely query user profile information with PowerShell - Tue, Nov 26 2013

Admins are often engaged in security audit activities. One common action item is to find all network shares with Full Control to Everyone and remove those permissions. Some tools are available on the Internet to do this, but a PowerShell script can be easily adapted for your purposes.

PowerShell script description ^

The PowerShell script described uses the Win32_LogicalShareSecuritySetting WMI class to query shares and their share permissions. The script returns a list of objects with details about each share and the security permissions set. The following command queries the shares:

Once the script gathers information about the shares, it processes each share in the list and queries name and security descriptor details. With this collected data, the script creates a new PSObject with the details we are interested in. The share name is a direct property ($Share.Name) for the object returned from the WMI query. Collecting security information is little more complex.

The script uses the GetSecurityDescriptor() method of the share object to get the security permissions list. The returned security permissions are again objects derived from the Win32_ACE WMI class. These security objects contain information about the account (user or domain) that has access to the share, the access mask (Full Control, Read, Write), and the access type (Allow/Deny/Audit). The script verifies the shares where the security group Everyone has Full Control permissions using the following IF condition:

Input ^

The script takes two arguments:

• ComputerName: Name of the computer(s) on which you want to find the shares with Everyone having Full Control. You can pass computer name(s) or pipe the input to the script. See the Usage Examples section for some examples.
• OutputDir: This is an optional parameter. By default, the script displays the output in Object format. If you want to get the list of shares where Everyone has Full Control in a single text file, specify the path of the folder where you need this file. When this parameter is specified, the script generates the list of shares and saves the details in a file called “Share Permissions <datetime>.log” in the folder you specified.

Output ^

By default, the script generates a table with three columns: EveryOneFullControl, ComputerName, and ShareName. The EveryOneFullControl column indicates whether a given share is configured with Everyone having Full Control or not. If so, the value is set to $true; if not, it is set to $false. The ComputerName column specifies the computer name on which the share is present. The ShareName column identifies the name of the share. For example:

PowerShell script output -  Security group Everyone has Full Control permissions

Usage Examples: ^

Find shares with Everyone having Full Control on a remote computer called PC1

Do the same operation (#1) on multiple computers:

Read server names from a text file and query for share details:

Save share details where Everyone has Full Control in a text file:

Download the PowerShell script

Join the 4sysops PowerShell group!

Your question was not answered? Ask in the forum!