用脚本检测并修复共享权限

wen 实用脚本 2026-07-26 158

本文目录导读：

用脚本检测并修复共享权限

PowerShell脚本 - 完整的检测与修复
快速检测脚本（自动模式）
批处理脚本（通用版本）
使用说明
安全最佳实践

我来为你提供几个用于检测和修复Windows共享权限的脚本方案。

PowerShell脚本 - 完整的检测与修复

# 共享权限检测与修复脚本
# 需要管理员权限运行
# 设置日志文件
$logFile = "C:\Temp\share_permissions_audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
$errorLog = "C:\Temp\share_permissions_errors_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
# 创建日志目录
if (-not (Test-Path "C:\Temp")) {
    New-Item -ItemType Directory -Path "C:\Temp" -Force
}
Function Write-Log {
    param([string]$Message, [string]$Type = "INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logMessage = "[$timestamp] [$Type] $Message"
    Write-Host $logMessage
    Add-Content -Path $logFile -Value $logMessage
}
Function Check-SharePermissions {
    param([string]$ShareName)
    Write-Log "检查共享: $ShareName" "INFO"
    try {
        # 获取共享信息
        $share = Get-SmbShare -Name $ShareName -ErrorAction Stop
        $sharePath = $share.Path
        # 检查文件夹是否存在
        if (-not (Test-Path $sharePath)) {
            Write-Log "共享路径不存在: $sharePath" "WARNING"
            return $false
        }
        # 获取共享权限
        $sharePermissions = Get-SmbShareAccess -Name $ShareName
        # 检查是否有Everyone完全控制
        $everyoneFullControl = $sharePermissions | Where-Object {
            $_.AccountName -eq "Everyone" -and 
            $_.AccessRight -eq "Full"
        }
        if ($everyoneFullControl) {
            Write-Log "发现安全风险: Everyone具有完全控制权限" "WARNING"
            return $false
        }
        # 检查NTFS权限
        $ntfsPermissions = Get-Acl -Path $sharePath
        Write-Log "NTFS权限已检查" "SUCCESS"
        return $true
    }
    catch {
        Write-Log "检查共享时发生错误: $_" "ERROR"
        Add-Content -Path $errorLog -Value "[ERROR] $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss'): $_"
        return $false
    }
}
Function Repair-SharePermissions {
    param(
        [string]$ShareName,
        [string]$RecommendedAction = "restrict"
    )
    Write-Log "修复共享: $ShareName" "ACTION"
    switch ($RecommendedAction) {
        "restrict" {
            try {
                # 移除Everyone完全控制
                Revoke-SmbShareAccess -Name $ShareName -AccountName "Everyone" -Force
                Write-Log "已移除Everyone的完全控制权限" "SUCCESS"
                # 添加更安全的默认权限
                Grant-SmbShareAccess -Name $ShareName -AccountName "Authenticated Users" -AccessRight Read -Force
                Write-Log "已添加Authenticated Users读取权限" "SUCCESS"
                # 保留Administrators完全控制
                Grant-SmbShareAccess -Name $ShareName -AccountName "BUILTIN\Administrators" -AccessRight Full -Force
                Write-Log "已确认Administrators完全控制权限" "SUCCESS"
            }
            catch {
                Write-Log "修复权限时发生错误: $_" "ERROR"
                Add-Content -Path $errorLog -Value "[ERROR] $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss'): $_"
            }
        }
        "custom" {
            # 可以根据需要自定义修复逻辑
            Write-Log "执行自定义修复" "INFO"
        }
    }
}
Function Audit-AllShares {
    Write-Log "开始全面共享权限审计" "START"
    Write-Log "=" * 50
    # 获取所有共享（排除默认共享）
    $allShares = Get-SmbShare | Where-Object {
        $_.Name -notmatch '^\$' -and  # 排除隐藏共享
        $_.Name -ne 'ADMIN$' -and 
        $_.Name -ne 'C$' -and 
        $_.Name -ne 'IPC$'
    }
    $issuesFound = 0
    $fixedIssues = 0
    foreach ($share in $allShares) {
        Write-Log "-" * 30
        Write-Log "处理共享: $($share.Name)"
        Write-Log "路径: $($share.Path)"
        $result = Check-SharePermissions -ShareName $share.Name
        if (-not $result) {
            $issuesFound++
            # 询问用户是否修复（自动模式可改为自动修复）
            $repair = Read-Host "发现安全问题，是否修复? (Y/N)"
            if ($repair -eq "Y" -or $repair -eq "y") {
                Repair-SharePermissions -ShareName $share.Name -RecommendedAction "restrict"
                $fixedIssues++
            }
        }
        else {
            Write-Log "共享权限检查通过" "SUCCESS"
        }
    }
    Write-Log "=" * 50
    Write-Log "审计完成!" "END"
    Write-Log "发现的问题: $issuesFound"
    Write-Log "已修复的问题: $fixedIssues"
    Write-Log "日志文件: $logFile"
    Write-Log "错误日志: $errorLog"
}
# 主执行部分
Function Main {
    # 检查管理员权限
    if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
        Write-Host "需要管理员权限运行此脚本!" -ForegroundColor Red
        Write-Host "请右键点击PowerShell，选择'以管理员身份运行'" -ForegroundColor Yellow
        exit 1
    }
    Write-Host "Windows共享权限检测与修复工具" -ForegroundColor Green
    Write-Host "1. 审计所有共享" -ForegroundColor Yellow
    Write-Host "2. 审计特定共享" -ForegroundColor Yellow
    Write-Host "3. 自动修复所有问题" -ForegroundColor Yellow
    Write-Host "4. 生成报告" -ForegroundColor Yellow
    $choice = Read-Host "请选择操作 (1-4)"
    switch ($choice) {
        "1" { Audit-AllShares }
        "2" {
            $shareName = Read-Host "请输入共享名称"
            Check-SharePermissions -ShareName $shareName
        }
        "3" {
            # 自动修复模式
            $allShares = Get-SmbShare | Where-Object { $_.Name -notmatch '^\$' }
            foreach ($share in $allShares) {
                $result = Check-SharePermissions -ShareName $share.Name
                if (-not $result) {
                    Repair-SharePermissions -ShareName $share.Name -RecommendedAction "restrict"
                }
            }
        }
        "4" {
            # 生成HTML报告
            Generate-HTMLReport
        }
    }
}
# 运行主函数
Main

快速检测脚本（自动模式）

# 快速共享权限检测脚本
# 自动检查并修复常见问题
$reportFile = "C:\Temp\share_security_report_$(Get-Date -Format 'yyyyMMdd').html"
# 扫描所有用户共享
$shares = Get-SmbShare | Where-Object { $_.Name -notmatch '^\$' -and $_.Name -ne 'ADMIN$' -and $_.Name -ne 'C$' -and $_.Name -ne 'IPC$' }
$issues = @()
foreach ($share in $shares) {
    $perms = Get-SmbShareAccess -Name $share.Name
    foreach ($perm in $perms) {
        if ($perm.AccountName -eq "Everyone" -or $perm.AccountName -eq "ANONYMOUS LOGON") {
            if ($perm.AccessRight -match "Full|Change") {
                $issues += [PSCustomObject]@{
                    ShareName = $share.Name
                    Account = $perm.AccountName
                    AccessRight = $perm.AccessRight
                    Severity = "High"
                    Action = "立即修复"
                }
            }
            elseif ($perm.AccessRight -eq "Read") {
                $issues += [PSCustomObject]@{
                    ShareName = $share.Name
                    Account = $perm.AccountName
                    AccessRight = $perm.AccessRight
                    Severity = "Medium"
                    Action = "评估是否需要"
                }
            }
        }
    }
}
# 输出结果
if ($issues.Count -gt 0) {
    Write-Host "发现 $($issues.Count) 个安全问题" -ForegroundColor Red
    $issues | Format-Table -AutoSize
    $fixAll = Read-Host "是否自动修复所有高严重性问题? (Y/N)"
    if ($fixAll -eq "Y") {
        $highIssues = $issues | Where-Object { $_.Severity -eq "High" }
        foreach ($issue in $highIssues) {
            Revoke-SmbShareAccess -Name $issue.ShareName -AccountName $issue.Account -Force
            Write-Host "已移除 $($issue.ShareName) 上的 $($issue.Account) 权限" -ForegroundColor Green
        }
    }
}
else {
    Write-Host "未发现严重安全问题" -ForegroundColor Green
}

批处理脚本（通用版本）

@echo off共享权限检测工具
color 0A
:: 需要管理员权限
net session >nul 2>&1
if %errorLevel% neq 0 (
    echo 请以管理员身份运行此脚本!
    pause
    exit /b 1
)
echo ========================================
echo    Windows共享权限检测与修复工具
echo ========================================
echo.
echo 正在扫描共享权限...
:: 列出所有共享
net share > temp_shares.txt
:: 检查常见的不安全配置
findstr /i "Everyone.*Full" temp_shares.txt > nul
if %errorLevel% equ 0 (
    echo [警告] 发现Everyone完全控制权限!
    echo.
    echo 建议修复:
    echo 1. 使用 net share 共享名 /delete 移除
    echo 2. 重新创建共享并设置适当权限
    echo.
    set /p fix="是否修复? (Y/N): "
    if /i "!fix!"=="Y" (
        :: 这里需要根据具体共享名执行修复
        echo 正在修复...
    )
)
:: 生成报告
echo.
echo 报告生成完成!
echo 详细结果请查看共享权限报告
del temp_shares.txt 2>nul
pause