CentOS远程操作Windows端授权（使用AD域）

请先确保CentOS机器可连接到对应Windows机器（可ping通）
请先确保Windows机器已加入AD域，且有set_acl.ps1赋权脚本
请先确保三台机器均在一个vpn下/局域网下，且两台windows均已挂载网络映射盘

环境

WindowsA （已加入AD域）

ip	192.168.50.229
userName	testyzr
hostName	CN_LAP119

WindowsB （本地）

ip	192.168.50.224
userName	ssikme

WindowsC （AD域）

ip	192.168.40.123
userName	admin-ad
hostName	pbstest.com

需求

在WindowsA，WindowsB已挂载Nas网络映射盘，其中WindowsA是通过有管理员权限的账户挂载的，WindowsB是普通用户挂载。现需要在WindowsB的Nas盘上建立新文件夹，用户PBSTEST/ljh有权限在此新文件夹下操作

执行步骤

1、在WindowsB下的挂载盘里创建新文件夹

2、在WindowsA/WindowsB查看文件夹权限

属性-->安全-->组或用户名查看

3、在CentOS内操作

（1）准备脚本test4.ps1

$net = new-object -ComObject WScript.Network
# 填你的映射盘地址，我这里是挂载到Y盘，后面填入你的域管理员账号和密码
$net.MapNetworkDrive( "Y:", "\\192.168.40.194\nas\sdm", $false, "PBSTEST\admin-ad", "password@3#" )

# 在WindowsA的赋权脚本path
$script2 = "D:\set_acl.ps1"
# 将PBSTEST\ljh账号加到Y:\testyzr7路径下，并赋权“Read，ReadData，ReadAndExecute”
& $script2 -Folder "Y:\testyzr7" -User "PBSTEST\ljh" -Rights "Read", "ReadData", "ReadAndExecute" -Flags "Allow"

（2）准备脚本test20240618.ps1

# 此脚本用于登录到windowsA系统里，需要填入管理员账号和密码
$account = "testyzr"
$password = "test12345"
$secpwd = convertto-securestring $password -asplaintext -force
$cred = new-object System.Management.Automation.PSCredential -argumentlist $account,$secpwd

# 通过以上凭证直接远程到WindowsA机器上运行test4.ps1脚本
Invoke-Command -ComputerName "192.168.50.229" -Authentication Negotiate -Credential $cred -FilePath /home/yzr/test4.ps1

（3）准备java脚本

//package com.yzr;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;

public class ExecuteCommand {
    public static void main(String[] args) {
        try {
            String scriptPath = "/home/yzr/test20240618.ps1";
            ProcessBuilder pb = new ProcessBuilder("pwsh", scriptPath);

            Process process = pb.start();
            print(process.getInputStream());

            process.waitFor();
        } catch (Exception e) {
            e.printStackTrace();
            return;
        }
    }

    public static void print(InputStream inputStream){
        try {
            BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
            String line;
            while ((line = reader.readLine()) != null) {
                System.out.println(line);
            }
            reader.close();
        }catch (Exception e){
            e.printStackTrace();
            System.out.println("出现异常..");
        }
    }
}

（4）运行Java脚本，查看是否已赋权

[yzr@localhost ~]$ java ExecuteCommand

（5）在WindowsA/WindowsB上查看权限

如图，已将PBSTEST\ljh赋权到文件夹testyzr7上

（6）进阶-并发测试java脚本（test.sh）

#!/bin/bash
echo "start..."

for((i=0;i<30;i++)); do
	# 这里的 & 会开启一个子进程执行
	{
                echo "start........."$i;
		java ExecuteCommand;
                echo "--------------------------------------done"$i
        } & 
done
# 使用 wait 命令阻塞当前进程，直到所有子进程全部执行完
wait
echo "you have download all files"

4、其他

（1）WindowsA下的授权脚本

位置：D:\set_acl.ps1

param (
    [Parameter(Mandatory=$true)]
    [string]$Folder,
    
    [Parameter(Mandatory=$true)]
    [string]$User,
    
    [Parameter(Mandatory=$true)]
    [string[]]$Rights,
    
    [Parameter(Mandatory=$true)]
    [string]$Flags
)

$InheritType = "ContainerInherit,ObjectInherit"
$AccessRights = [System.Security.AccessControl.FileSystemRights]$Rights
$AccessControlType = [System.Security.AccessControl.AccessControlType]$Flags

$tmpAR = New-Object System.Security.AccessControl.FileSystemAccessRule($User, $AccessRights, $InheritType, "None", $AccessControlType)
$rule = New-Object 'security.accesscontrol.filesystemaccessrule'("CREATOR OWNER",@("ReadAndExecute,Synchronize"),"ContainerInherit,Objectinherit","Inheritonly","Allow")
#.\set_acl.ps1 -Folder "E:\test" -User "PBSTEST\zhry" -Rights "ReadAndExecute" -Flags "Allow"
Write-Host "$Folder"
Write-Host "$User"
Write-Host "$Rights"
Write-Host "$Flags"
Write-Host "Hello, $tmpAR!"
Write-Host "111,$InheritType,$AccessRights,$AccessControlType"
Write-Host "Hello, $rule!"

# Add ACL to this folder
$Acl = Get-ACL -Path $Folder -Audit
$Acl.AddAccessRule($tmpAR)
Set-ACL -Path $Folder -AclObject $Acl