Find and lock down lax Windows share permissions

Gathering file shares and their authorized users

First, we need to find the file shares on the servers and client systems. We could do this either by using the Get-SmbShare command or by calling the win32_share namespace using either Get-CimInstance or Get-WmiObject.

For this example, Get-WmiObject is the preferred way to fetch our shares because it's a more streamlined approach. Launch the PowerShell Terminal as an admin on a file server and enter the following command:

Get-WMIObject -Class win32_share
 
 Name       Path                              Description    
 ----       ----                              -----------    
 MyShare    C:\demo\share                     Demo share                    
 ADMIN$     C:\WINDOWS                        Remote Admin   
 C          C:\                                              
 C$         C:\                               Default share  
 D$         D:\                               Default share  
 E$         E:\                               Default share  
 IPC$                                         Remote IPC     
 print$     C:\WINDOWS\system32\spool\drivers Printer Drivers
 scripts    C:\scripts

The PowerShell command outputs all the shares, but it doesn't show the users with access to them. That's because the Windows share permissions reside in another namespace called Win32_LogicalShareSecuritySetting:

Get-WmiObject -Class Win32_LogicalShareSecuritySetting

This resulting output doesn't tell us much either. We need a more comprehensive PowerShell script to generate something more useful:

# Get all shares on the computer
 $Shares = Get-WMIObject -Class win32_share
 
 # Variable to processed shares to.
 $NetworkShares = [System.Collections.Generic.List[PSCustomObject]]::new()
 
 # Ignore default shares by filtering out '2147483648'
 foreach ($Share in $Shares | ? {$_.Type -ne '2147483648' -and $_.Name -ne 'print$'}) {
 
     # Create an object that we'll return
     $ShareObject = [PSCustomObject]@{
         Name = $Share.Name
         Description = $Share.Description
         LocalPath = $Share.Path
         ACL = [System.Collections.ArrayList]::new()
 
     }
     # Get the security settings for the share
     $ShareSecurity = Get-WmiObject -Class Win32_LogicalShareSecuritySetting -Filter "name='$($Share.Name)'"
 
     # If security settings exists, build a list with ACLs
     if($Null -ne $ShareSecurity){
         Try{  
             $SecurityDescriptor = $ShareSecurity.GetSecurityDescriptor().Descriptor    
         
             foreach($AccessControl in $SecurityDescriptor.DACL){   
             
                 $UserName = $AccessControl.Trustee.Name      
                 $Trustee = $AccessControl.Trustee
 
                 If ($Trustee.Domain -ne $Null) {
                     $UserName = "$($Trustee.Domain)\$UserName"
                 }
             
                 If ($Trustee.Name -eq $Null) {
                     $UserName = $Trustee.SIDString
                 }
 
                 $ShareObject.ACL.Add(
                     [System.Security.AccessControl.FileSystemAccessRule]::new(
                         $UserName,
                         $AccessControl.AccessMask,
                         $AccessControl.AceType
                     )
                 ) | Out-Null
             }
 
             # Return the share object with the ACLs
             $NetworkShares.Add($ShareObject)
         }
         Catch{
             Write-Error $Error[0]
         }
     }
     Else {
         Write-Information "No permissions found for $($Share.Name) on $ComputerName"
     }
 }

The content of the $NetworkShares variable should end up looking similar to the following:

PS51> $NetworkShares

Name       Description LocalPath     ACL                                                                                                     
 ----       ----------- ---------     ---                                                                                                     
 DemoShare  Demo share  C:\demo\share {System.Security.AccessControl.FileSystemAccessRule}                                                    
 scripts                C:\scripts    {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule}
 
 PS51> $NetworkShares[0].ACL
 
 FileSystemRights  : FullControl
 AccessControlType : Allow
 IdentityReference : Everyone
 IsInherited       : False
 InheritanceFlags  : None
 PropagationFlags  : None

We've successfully gathered data about our Windows share permissions, showing who has access to what. That might not be enough because administrators usually assign network share permissions on the NTFS level, not the network share level.

We also need to check the files and folders in the share if there are excessive permissions for other groups, such as Everyone or Domain Users.

Scanning file permissions using AccessChk

We have a list of our file shares. Next, we need to get all the file permissions. The fastest way to do this is by using the AccessChk file utility from the Sysinternals suite and parse the output with PowerShell.

Put AccessChk on your file server and copy the AccessChk64.exe file to your system32 folder. You can either download the utility from the link above or use the following PowerShell code to download it and copy it to your system32 folder:

Invoke-WebRequest -OutFile $env:TEMP\AccessChk.zip -Uri https://download.sysinternals.com/files/AccessChk.zip 
 Expand-Archive -Path $env:TEMP\AccessChk.zip -DestinationPath $env:TEMP -Force
 Copy-Item -Path $env:TEMP\AccessChk64.exe C:\Windows\System32\AccessChk64.exe

We can use PowerShell to create a wrapper function around AccessChk for use in a script:

Function Invoke-AccessChk {
     param(
         $Path,
         $Principals,
         $AccessChkPath = "$env:windir\system32\accesschk64.exe",
         [switch]$DirectoriesOnly,
         [switch]$AcceptEula
         
     )
 
     # Accept EULA 
     if($AcceptEula){
         & $AccessChkPath /accepteula | Out-Null
     }
 
     $Argument = "uqs"
     if($DirectoriesOnly){
         $Argument = "udqs"
     }
 
     $Output = & $AccessChkPath -nobanner -$Argument $Path
     
     Foreach($Row in $Output){
 
         # If it's a row with a file path output the previous object and create a new one
         if($Row -match "^\S"){
             If($Null -ne $Object){
                 if($Object.Access.Keys.Count -gt 0){
                     $Object
                 }
             }
             $Object = [PSCustomObject]@{
                 Path = $Row
                 Access = @{}
             }
         }
 
         # If it's a row with permissions
         if($Row -match "^  [R ][W ]"){
             If($Row -match ($Principals -replace "\\",'\\' -join "|")){
 
                 $Row -match "^  (?<Read>[R ])(?<Write>[W ]) (?<Principal>.*)" | Out-Null        
                 
                 $Object.Access[$Matches.Principal] = @{
                     Read = $Matches.Read -eq 'R'
                     Write = $Matches.Read -eq 'W'
                 }
 
             }
         }
     }
     # If it's the last row - output the object once more
     if($Object.Access.Keys.Count -gt 0){
         $Object
     }
 }

We can now run Invoke-AccessChk with the network shares stored in the $NetworkShares variable from the previous step. We add to a list of the security principals -- without "domain" -- to find:

# Invoke-AccessChk will only output files/folders where the following principals have permission:
 $RiskPrincipals = @(
     'Everyone',
     'Domain Users',
     'Domain Computers',
     'Authenticated Users',
     'Users'
 )
 
 $RiskyPermissions = Foreach($NetworkShare in $NetworkShares | Select -First 1){
     
     # Only scan directory if it's shared to one of the principals in $RiskPrincipals
     $RiskPrincipalExist = $Null -ne ($NetworkShare.ACL.IdentityReference.Value -replace ".*\\" | ? {$_ -in $RiskPrincipals})
     
     if($RiskPrincipalExist){
         Invoke-AccessChk -Path $NetworkShare.LocalPath -Principals $RiskPrincipals
     }
 
 }

The $RiskyPermissions variable will give output similar to this:

PS51> $RiskyPermissions
 
 Path                                          Access                                           
 ----                                          ------                                           
 C:\demo\share\File1.txt                       {BUILTIN\Users, NT AUTHORITY\Authenticated Users}
 C:\demo\share\Folder1\picture.png             {NT AUTHORITY\Authenticated Users}               
 C:\demo\share\Folder1\Folder2                 {NT AUTHORITY\Authenticated Users}
 
 PS51> $RiskyPermissions[0].Access

Creating a report from several computers and servers

Thus far, you can get a list of all the file shares and check all the files with the PowerShell wrapper for Invoke-AccessChk. One of PowerShell's many strengths is its ability to scale. PowerShell remoting will take the code we've produced to the next level to gather the information from several computers at once.

First, we need a list of computers and servers to scan. If possible, the easiest way is through the Active Directory module from RSAT:

$Computers = (Get-ADComputer -Filter *).dnsHostName

This method might not be an option in larger environments that are heavily segmented. Another approach is to get data from your configuration management database or entering it manually using the following example:

$Computers = @(
     'Server1',
     'Server2',
     'Server3',
     'Server4',
     'Server5',
   'PC1'
   # etc
 )

Now it's time to tie all these components in a script that uses PowerShell background jobs to do the following actions on the machines specified in the $Computers parameter:

• Get all shares that are shared out to one of the principals in $RiskPrincipals.
• Download AccessChk if it does not already exist.
• Check the NTFS permission of all shares gathered by AccessChk.
• Return an object with a list with all files where the security principals in $RiskPrincipals have either read or write permissions.

The computer running the script will then collect the results of all jobs and output it to a CSV file with the name ShareAccessReport.

Remember to run the following as an admin on a computer that has network access to said machines and to accept the EULA for AccessChk by changing $AcceptEula to true:

$Computers = @(
     'Server-1',
     'Server-2',
     'PC-1'
 )
 
 # Accept EULA for AccessChk
 # CHANGE TO TRUE
 $AcceptEula = $false
 
 if(!$AcceptEula){
     Write-Warning "Did not accept EULA for AccessChk, can't continue"
   break
 }
 
 # Principals  that we want to scan for
 $RiskPrincipals = @(
     'Everyone',
     'Domain Users',
     'Domain Computers',
     'Authenticated Users',
     'Users'
 )
 
 # List of shares that we want to ignore.
 # Setting a share name tied to it just in case since it should almost always be that path
 $IgnoreShares = @(
     'print$'
 )
 
 # Scriptblock that we'll send with Invoke-Command
 $Scriptblock = {
 
     $RiskPrincipals = $args[0].RiskPrincipals
     $IgnoreShares = $args[1].IgnoreShares
     $AcceptEula = $args[2].AcceptEula
 
     # Functions to download and use AccessChk
     # It utilizes a shell object instead of Expand-Archive for backward compatability
     Function Download-AccessChk {
         param(
             $Url = "https://download.sysinternals.com/files/AccessChk.zip",
             $Dest = $env:temp
         )
         if(Test-Path "$dest\accesschk.zip"){
             rm $Dest\AccessCHK.zip -Force
         }
         (New-Object System.Net.WebClient).DownloadFile($url, "$env:temp\AccessChk.zip")
         $Shell = New-Object -ComObject Shell.Application
         $Zip = $shell.NameSpace("$env:temp\AccessChk.zip")
         $Destination = $shell.NameSpace("$env:windir\system32\")
 
         $copyFlags = 0x00
         $copyFlags += 0x04
         $copyFlags += 0x10
 
         $Destination.CopyHere($Zip.Items(), $copyFlags)
     }
 
     # The function that utilizes accesschk from part 2
     Function Invoke-AccessChk {
         param(
             $Path,
             $Principals,
             $AccessChkPath = "$env:windir\system32\accesschk64.exe",
             [switch]$DirectoriesOnly,
             [switch]$AcceptEula
         
         )
 
         if(!(Test-Path "$env:windir\system32\accesschk64.exe")){
             Download-AccessChk
         }
 
         # Accept EULA 
         if($AcceptEula){
             & $AccessChkPath /accepteula | Out-Null
         }
 
         $Argument = "uqs"
         if($DirectoriesOnly){
             $Argument = "udqs"
         }
 
         $Output = & $AccessChkPath -nobanner -$Argument $Path
     
         Foreach($Row in $Output){
 
             # If it's a row with a file path output the previous object and create a new one
             if($Row -match "^\S"){
                 If($Null -ne $Object){
                     if($Object.Access.Keys.Count -gt 0){
                         $Object
                     }
                 }
                 $Object = [PSCustomObject]@{
                     Path = $Row
                     Access = @{}
                 }
             }
 
             # If it's a row with permissions
             if($Row -match "^  [R ][W ]"){
                 If($Row -match ($Principals -replace "\\",'\\' -join "|")){
 
                     $Row -match "^  (?<Read>[R ])(?<Write>[W ]) (?<Principal>.*)" | Out-Null        
                 
                     $Object.Access[$Matches.Principal] = @{
                         Read = $Matches.Read -eq 'R'
                         Write = $Matches.Read -eq 'W'
                     }
 
                 }
             }
         }
         # If it's the last row - output the object once more
         if($Object.Access.Keys.Count -gt 0){
             $Object
         }
     }
 
 
     # Get all the shares by using WMI
     $Shares = Get-WmiObject -Class win32_share
 
     # Create an object that we will later return when we're done
     $ReturnObject = [PSCustomObject]@{
         ComputerName = $ComputerName
         NetworkShares = [System.Collections.Generic.List[PSCustomObject]]::new()
         AccessibleObjects = @{}
     }
 
     # Ignore default shares by filtering out '2147483648'
     # Ignore shares in $IgnoreShares
     foreach ($Share in $Shares | ? {$_.Type -ne '2147483648'} | ? {$_.Name -notin $IgnoreShares}) {
         $ShareObject = [PSCustomObject]@{
             Name = $Share.Name
             Description = $Share.Description
             LocalPath = $Share.Path
             ACL = [System.Collections.ArrayList]::new()
 
         }
 
         $ShareSecurity = Get-WMIObject -Class Win32_LogicalShareSecuritySetting -Filter "name='$($Share.Name)'"
         if($Null -ne $ShareSecurity){
             Try{  
                 $SecurityDescriptor = $ShareSecurity.GetSecurityDescriptor().Descriptor    
         
                 foreach($AccessControl in $SecurityDescriptor.DACL){   
             
                     $UserName = $AccessControl.Trustee.Name      
                     $Trustee = $AccessControl.Trustee
 
                     If ($Trustee.Domain -ne $Null) {
                         $UserName = "$($Trustee.Domain)\$UserName"
                     }
             
                     If ($Trustee.Name -eq $Null) {
                         $UserName = $Trustee.SIDString
                     }
             
                     $ShareObject.ACL.Add(
                         [System.Security.AccessControl.FileSystemAccessRule]::new(
                             $UserName,
                             $AccessControl.AccessMask,
                             $AccessControl.AceType
                         )
                     ) | Out-Null
                 }
 
                 # Only add network share if it contains a risk user/group
             
                 $Match = $False
                 Foreach($IdentityReference in $ShareObject.ACL.IdentityReference.Value){
                     Foreach($Pattern in $RiskPrincipals){
                         if($IdentityReference -Match $Pattern){               
                             $Match = $True
                         }
                     }
                 }
                 if($Match){
                     $ReturnObject.NetworkShares.Add($ShareObject)    
                 }
                 Else {
                     Write-Verbose "No match for risky groups, not adding"
                 }
                
             }
             Catch{
                 Write-Error $Error[0]
             }
         }
         Else {
             Write-Information "No permissions found for $($Share.Name) on $ComputerName"
         }
       
     }
     # Get all files from NetworkShares where a principal from $RiskPrincipals have either read or write access
     $ReturnObject.NetworkShares | Foreach {
         $ReturnObject.AccessibleObjects[$_.Name] = Invoke-AccessChk -Path $_.LocalPath -Principals $RiskPrincipals -AcceptEula:$AcceptEula
     }
 
     # Done! Lets return the returnobject:
     $ReturnObject
 }
 
 # To add to the argument list of Invoke-Job because the remote PowerShell job doesn't have access to our variable space.
 $InvokeParam = @{
     RiskPrincipals = $RiskPrincipals
     IgnoreShares = $IgnoreShares
     AcceptEula     = $AcceptEULA
 }
 
 # Start jobs
 $Job = Invoke-Command -AsJob -ComputerName $Computers -ArgumentList $InvokeParam -ScriptBlock $Scriptblock
 
 # Wait for jobs to finish
 $Job | Wait-Job
 
 # Collect data from all jobs
 $Output = Get-Job | Receive-Job
 
 # Output the output into a CSV
 $ToCSV = Foreach($Result in $Output){
 
     Foreach($Key in $Result.AccessibleObjects.Keys) {
 
         # For using Select-Object expressions to get the data out of $Result.AccessibleObjects
         # The downside of working a lot with hashtables
         $ReadAccess = @{
             Name='ReadAccess'
             Expression={
                 $Base = $_.Access
                 ($Base.Keys | ? {$Base[$_].Read}) -join ","
             }
         }
 
         $WriteAccess = @{
             Name='WriteAccess'
             Expression={
                 $Base = $_.Access
                 ($Base.Keys | ? {$Base[$_].Write}) -join ","
             }
         }
         
         # Select from AccessibleObjects and create property for the principals with ReadAccess and WriteAccess
         $Result.AccessibleObjects[$Key] | Select @{Name='ShareName';Expression={$Key}},Path,$ReadAccess,$WriteAccess
     }
 }
 # Export the CSV
 $ToCSV | Export-Csv -Path .\ShareAccessReport.csv

When the PowerShell job finishes, it will create a full report of the access of the principals in the $RiskyPrincipals variable.

Fixing Windows share permissions

After you review the CSV and find the permissions that need adjusting, there are two ways to correct them. If there are only a few, then the best way is through the GUI. But if there are thousands, then the following command will use the CSV output to speed this along:

# This needs to run locally on the server with the file share.
 
 $UserToRemove = 'Guest'
 $CSV = Import-Csv -Path .\ShareAccessReport.csv | ? {}
 $CSV | ? {$_.ComputerName -eq $env:COMPUTERNAME} | Foreach {
     $ACL = Get-Acl -Path $_.Path
     $ACL.Access | ? {($_.IdentityReference.Value -replace '.*\\') -eq $UserToRemove} | Foreach {
         $ACL.Access.Remove($_)
     }
 }

This PowerShell script will remove all permissions for the Guest security principal.

The first report will usually bring a lot of work though because it will discover a lot of oddities and risks when it comes to your Windows share permissions. But running a solution like this regularly, especially targeted toward shares with sensitive information, will pay off in the end.