How to test writing to a file share path using credential?

Question

I have an array of Credential objects and I would like to test that these credentials have permissions to write a file to a file share.

I was going to do something like

$myPath = "\\path\to\my\share\test.txt"
foreach ($cred in $credentialList)
{
    "Testing" | Out-File -FilePath $myPath -Credential $cred
}

but then I discovered that Out-File doesn't take Credential as a parameter. What's the best way to solve this?

Answer 1

You can use New-PSDrive:

$myPath = "\\path\to\my\share"

foreach ($cred in $credentialList)
{
  New-PSDrive Test -PSProvider FileSystem -Root $myPath -Credential $Cred
  "Testing" | Out-File -FilePath Test:\test.txt 
  Remove-PSDrive Test
}

Answer 2

Here is asituation where an old exe (net.exe) seems to do better than powershell... I guess you could try to map a network drive with the credential provided then test to write a file to that drive :

$cred=get-credential 
$pass=$cred.GetNetworkCredential().Password 
net use q: \\servername\share $pass /user:$cred.username  

Answer 3

Use this script taken from Microsofts TechNet Script Center : http://gallery.technet.microsoft.com/scriptcenter/Lists-all-the-shared-5ebb395a

It is a lot easier to alter to fit your needs then to start completely from scratch. Open up ListSharedFolderPermissions.ps1, and find the three $Properties vars. add a line at the top of each one so you can tell which user your looking at, so it should now look like this:

$Properties = @{'Username' = $Credential.UserName
               'ComputerName' = $ComputerName
                  . . . . .                   }

Next, add your new Username property to the select-object line (3 times) :

$Objs|Select-Object Username,ComputerName,ConnectionStatus,SharedFolderName,SecurityPrincipal, `
        FileSystemRights,AccessControlType

Once youve added those small pieces in the six appropriate places your script is ready to use:

cd c:\Path\where\you\put\ps1\file
$permissions = @()
$myPath = "computername"
foreach ($cred in $credentialList)
{
   $permissions += .\ListAllSharedFolderPermission.ps1 -ComputerName $myPath -Credential $cred
   $permissions += " "
}
$permissions | Export-Csv -Path "C:\Permission.csv" -NoTypeInformation

Answer 4

Try using the Invoke-Command function. It will take a credential object and allow you to run an arbitrary script block under that command. You can use that to test out writing the file

Invoke-Command -ScriptBlock { "Testing" | Out-File $myPath } -Credential $cred

Answer 5

I think the Invoke-command approach should work. But if nothing works you can try the powershell impersonation module. It successfully impersonates a user for most Powershell commands without the -Credential switch.

Answer 6

A few ideas:

• Create your own PowerShell Provider
• Impersonate a user and then write to the share (not sure if possible in powershell)
• Use net use d:... as @Kayasax has suggested
• Use WScript.Network

I'm very interested in the PowerShell provider myself, but I decided to make something real quick so I went with using the WScript.Network library. I used a hash table to track whether a user would be "authenticated" or not.

$credentials = @() # List of System.Net.NetworkCredential objects

$authLog = @{}
$mappedDrive = 'z:'
$tmpFile = $mappedDrive, '\', [guid]::NewGuid(), '.tmp' -join ''
$path = [io.path]::GetPathRoot('\\server\share\path')

$net = new-object -comObject WScript.Network
foreach ($c in $credentials) {
    if ($authLog.ContainsKey($c.UserName)) {
        # Skipping because we've already tested this user.
        continue
    }
    try {
        if (Test-Path $mappedDrive) {
            $net.RemoveNetworkDrive($mappedDrive, 1) # 1 to force
        }

        # Attempt to map drive and write to it
        $net.MapNetworkDrive($mappedDrive, $path, $false, $c.UserName, $c.Password)
        out-file $tmpFile -inputObject 'test' -force

        # Cleanup
        Remove-Item $tmpFile -force
        $net.RemoveNetworkDrive($mappedDrive, 1)

        # Authenticated.
        # We shouldn't have reached this if we failed to mount or write
        $authLog.Add($c.UserName, 'Authorized')
    }
    catch [Exception] {
        # Unathenticated
        $authLog.Add($c.UserName, 'Unauthorized')
    }
}
$authLog

# Output

Name                           Value
----                           -----
desktop01\user01               Authorized
desktop01\user02               Unauthorized