Odd behavior making a large number of folders in network share.

Copper Contributor

Hey everyone, 

 

This is my first post here and I'm really hoping for some insights. I've been beating my head against the wall for awhile trying to puzzle out why this code isn't working as intended . The goal of the project is to fetch the membership of a group, create home folders for everyone, and then assign each user modify permissions.

 

When I test this script on a small group of 3-10 people, it works exactly as I want it to. The group it was built for is approximately 800 people and that's where it doesn't seem to do anything...BUT if I change the intended network path to a faux home directory on my c drive, 'c:\test_home' , it creates all the folders it is supposed to with the needed permissions. 

 

Basically, it works perfect with small group targets and I have to change the network path for the large group. Permissions don't appear to be an issue and the intended directory has plenty of free space.

 

$UserBase = Get-ADGroupMember "IT Test Collection" -Server "server"|`
ForEach-Object {
$HomePath = "\\HomePath\shared\$($_.samaccountname)"
$TestPath = Test-Path $HomePath
if (!$TestPath) {md $HomePath -Force}

$Rights = [System.Security.AccessControl.FileSystemRights]"Modify"
$InheritanceFlag = @([System.Security.AccessControl.InheritanceFlags]::ContainerInherit,[System.Security.AccessControl.InheritanceFlags]::ObjectInherit)
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None
$objType =[System.Security.AccessControl.AccessControlType]::Allow
$objUser = New-Object System.Security.Principal.NTAccount "xxx\$($_.samaccountname)"
$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule ($objUser, $Rights, $InheritanceFlag, $PropagationFlag, $objType)
$ACL = Get-Acl $HomePath
$ACL.AddAccessRule($objACE)
Set-ACL $HomePath $ACL
}

 

 

 

 

I would very much appreciate any insights or guidance. Thank you so much for your time.

 

 

1 Reply

It turns out get-adgroupmember doesn't do well with a large group. I used a longer method to replace that cmdlet and it's doing it's thing. Hopefully this is beneficial to someone in the future. 

 

(get-adgroup -properties members).members|get-aduser - properties samacountname