Sharing a folder for a specific machine/user using powershell

Question

I'm trying to share a folder to a specific machine/user using Powershell.

Some background: I've many Windows machines which have a folder (data folders) that needs to be backed up. These folders are shared with a "special" machine running backup software. This software daily checks the contents of the data folders and backup the data to its local harddisks. When a new machine arrives, we share the folder by hand using Explorer. (Properties -> sharing -> share ...). All the machines are part of a large network, and we don't want to share the data with all the machines. Therefore we only allow read access to the data folder by the backup machine (let's call the user on the backup machine domain\BackupUser). I want to move the creation of these shared data folders into some script which we can run from Powershell.

The command I found is: New-SmbShare -Path C:\Data\ -Name Data -ReadAccess "domain\BackupUser". The command will create the (smb) share as expected, and I can observe it via the backup machine. But on access it, the permission is denied. When listing the shared folder access (Get-SmbShareAccess -Name "Data") it does show the expected user. I've also tried to create the shared folder with: net share Data=C:\Data /grant:BackupUser,FULL but still got the permission is denied error. The weird thing is when the folder is shared using explorer and list the access (`Get-SmbShareAccess -Name "Data"). The user (BackupUser) is not listed, but an "Everyone" is shown. But when trying to access the data folder from another (random) machine, it does not give access, as desired. The backup machine does have access.

So, the main question: What powershell command(s) creates a new shared folder to a specific machine/user?

Scepticalist Scepticalist · Accepted Answer · 2019-05-08T11:08:43

Share permissions are not the same as file system permissions.

Set the SHARE permission, then apply the FOLDER/FILE permissions:

$FolderName = 'C:\Data'
$UserId = 'DOMAIN\BackupUser'
New-SmbShare -Path $FolderName -Name Data -ReadAccess $UserId

$Acl = Get-Acl $FolderName
$NewAccessRule = New-Object system.security.accesscontrol.filesystemaccessrule($UserId,"Read","Allow")
$Acl.SetAccessRule($NewAccessRule)
Set-Acl $FolderName $Acl

Sharing a folder for a specific machine/user using powershell

1 Answers