60 lines
2.9 KiB
PowerShell
60 lines
2.9 KiB
PowerShell
|
#Function to check if Mods Directory is secured.
|
||
|
|
#Security: Mods directory must be protected (Users could create scripts of their own - then they'll run in System Context)!
|
||
|
|
#Check if Local Users have write rights in Mods directory or not (and take action if necessary):
|
||
|
|
|
||
|
|
function Invoke-ModsProtect ($ModsPath) {
|
||
|
|
$directory = Get-Item -Path $ModsPath
|
||
|
|
$acl = Get-Acl -Path $directory.FullName
|
||
|
|
#Local Users - S-1-5-32-545
|
||
|
|
$userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
|
||
|
|
#Translate SID to Locale Name
|
||
|
|
$ntAccount = $userSID.Translate([System.Security.Principal.NTAccount])
|
||
|
|
$userName = $ntAccount.Value
|
||
|
|
$userRights = [System.Security.AccessControl.FileSystemRights]"Write"
|
||
|
|
|
||
|
|
$hasWriteAccess = $False
|
||
|
|
|
||
|
|
foreach ($access in $acl.Access) {
|
||
|
|
if ($access.IdentityReference.Value -eq $userName -and $access.FileSystemRights -eq $userRights) {
|
||
|
|
$hasWriteAccess = $True
|
||
|
|
break
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($hasWriteAccess) {
|
||
|
|
#Disable inheritance
|
||
|
|
$acl.SetAccessRuleProtection($True, $True)
|
||
|
|
# Remove any existing rules
|
||
|
|
$acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
|
||
|
|
#SYSTEM Full - S-1-5-18
|
||
|
|
$userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
|
||
|
|
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
|
||
|
|
$acl.SetAccessRule($rule)
|
||
|
|
# Save the updated ACL
|
||
|
|
Set-Acl -Path $directory.FullName -AclObject $acl
|
||
|
|
|
||
|
|
#Administrators Full - S-1-5-32-544
|
||
|
|
$acl = Get-Acl -Path $directory.FullName
|
||
|
|
$userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
|
||
|
|
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
|
||
|
|
$acl.SetAccessRule($rule)
|
||
|
|
Set-Acl -Path $directory.FullName -AclObject $acl
|
||
|
|
|
||
|
|
#Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
|
||
|
|
$acl = Get-Acl -Path $directory.FullName
|
||
|
|
$userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
|
||
|
|
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
|
||
|
|
$acl.SetAccessRule($rule)
|
||
|
|
Set-Acl -Path $directory.FullName -AclObject $acl
|
||
|
|
|
||
|
|
#Authenticated Users ReadAndExecute - S-1-5-11
|
||
|
|
$acl = Get-Acl -Path $directory.FullName
|
||
|
|
$userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
|
||
|
|
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
|
||
|
|
$acl.SetAccessRule($rule)
|
||
|
|
Set-Acl -Path $directory.FullName -AclObject $acl
|
||
|
|
|
||
|
|
return $True
|
||
|
|
}
|
||
|
|
return $False
|
||
|
|
}
|