Monday, November 19, 2018

PowerShell Security Scan With Tree View Output

As I started my work to migrate files from file shares to SharePoint, I realized that I needed to have some sort of scan of the existing structure and security as it is.  I needed this to be friendly enough to hand over to regular users so that they could have an idea of what kind of work needed to be done for migration preparation. 

Since users are familiar with the tree hierarchy I wanted to be able to output something to them that would maintain this look and feel.  I also wanted them to be able to hide sections of the output.  If a large part of the structure is just inheriting permissions, doesn't apply, have been dealt with, or whatever, I wanted them to be able to shut that section down.

PowerShell doesn't really have a good output for tree views.  Sure, tree is around, but it wouldn't serve my needs.  Maybe I just don't know it well enough yet...
I didn't want an Excel output, because it really doesn't have a great tree view.  Again, maybe I just don't know the product well enough.

I chose to create a simple HTML file as the output and use some simple CSS and JavaScript to get the functionality I wanted.  One of the cleanest tree views I have seen comes from W3Schools.com.  They have a great site for this kind of thing and their tree view was exactly what I was looking for.

Once I figured out how to layout the HTML and how the nested unorganized lists would work, the whole thing came together pretty quickly.  PowerShell has some out of the box cmdlets that do the heavy lifting.  I made use of the normal Get-Item and Get-ChildItem cmdlets to get collections of the folder objects, then simply called the Get-Acl cmdlet to get the security of the folder. 
The ACL return object of the Get-Acl cmdlet has a handy property, isinherited, that will let you know if the folder inherits security or has custom security.

The only tricky part of all of this was getting the HTML set up.  The nesting works by having the child items contained in an unorganized list with a "nested" class designation enclosed within the parent's line item.  The parent line item is surrounded by a caret class to attach the JavaScript click functionality.

In deep folder taxonomies, the list nesting and closing can get pretty complex.  I solved this by using three functions...  One that set the parent folder HTML structure, one that closed the parent HTML structure, and one that created the childless folder structure.

When all of the shouting was over, I had a reasonably elegant script that determined if a folder had child items.  If it did, it was designated a parent item and the parent HTML was written.  The child folder collection was then sent to a loop that simply called on the function that determined if it was a parent, and so on.