Use this script to check if splunkUF have read rights in selected folders
$csvFilePath = "c:\users\MyUser\desktop\test_host.csv" $serviceAccountName = "NT SERVICE\SplunkForwarder" $permission = "Read, ReadAndExecute, Synchronize" $Computers = Import-Csv -Path $csvFilePath -Delimiter "," ForEach ($Myhost in $Computers) { $targetHost = ($Myhost).Hosts $folderPaths = ($Myhost).FolderPaths -split ';' Write-host "Working in: "$targetHost $session1 = New-PSSession -ComputerName $targetHost foreach ($targetFolderPath in $folderPaths) { Write-host -NoNewline "- Checking: "$targetFolderPath " - " $subfolders = Invoke-Command -Session $session1 -ArgumentList $targetFolderPath -ScriptBlock{param($targetFolderPath) Get-ChildItem -Path $targetFolderPath -Recurse | where {$_.Attributes -eq "directory"} | select -ExpandProperty fullname} $readAcl = Invoke-Command -Session $session1 -ArgumentList $targetFolderPath -ScriptBlock{(Get-Acl -Path $TargetFolderPath).Access} $readAcl = $readAcl | where {$_.identityreference -like "NT Service\splunkforwarder" -or $_.identityreference -like "BUILTIN\users" -and $_.filesystemrights -like "ReadAndExecute*" -and $_.Accesscontroltype -like "Allow" } if($readacl -notlike $null) { Write-host "OK" -ForegroundColor Green } else { write-host "Access saknas" -ForegroundColor Red } foreach ($subfolder in $subfolders) { Write-host -NoNewline "- - Checking: "$subfolder " - " $readAcl = Invoke-Command -Session $session1 -ArgumentList $subfolder -ScriptBlock{param($Subfolder) (Get-Acl -Path $subfolder).Access} $readAcl = $readAcl | where {$_.identityreference -like "NT Service\splunkforwarder" -or $_.identityreference -like "BUILTIN\users" -and $_.filesystemrights -like "ReadAndExecute*" -and $_.Accesscontroltype -like "Allow" } if($readacl -notlike $null) { Write-host "OK" -ForegroundColor Green } else { write-host "Access saknas" -ForegroundColor Red } } } Remove-PSSession -Session $session1; write-host `n }Format of CSV file
Hosts,FolderPaths Host1,C:\inetpub\logs\LogFiles\;D:\inetpub\logs\LogFiles\ Host2,C:\inetpub\logs\LogFiles\;D:\inetpub\logs\LogFiles\ Host3,C:\inetpub\logs\LogFiles\;D:\inetpub\logs\LogFiles\ Host4,C:\inetpub\logs\LogFiles\;D:\inetpub\logs\LogFiles\