Prérequis pour un environnement de partage de fichiers

<#
.SYNOPSIS
	Grants or revokes access to an Event Log
.DESCRIPTION
	Controls access to an Event Log, supporting:
		Grant or revoke access
		Local or domain user or group
		Local or remote Event Log
		Read or read/write access
		Connect to remote machine as current or alternate user
		Target a group of remote machines via a text file
.PARAMETER Action
	The action to take (Get, Grant or Revoke)
.PARAMETER LogName
	The Event Log log name (Application, Security or System)
.PARAMETER AccountName
	The domain-qualified user or group name
.PARAMETER Access
	The type of rights to grant (Read or ReadWrite)
.PARAMETER ComputerName
	The remote computer name (optional)
.PARAMETER UserName
	User name for remote computer login (optional)
.PARAMETER Password
	Password for remote computer login (optional)
.PARAMETER ComputerNamesFile
	Name of a text file containing computer names to affect, one name per line (optional)
.EXAMPLE
	ControlEventLogPermissions.ps1 -Action 'Grant' -LogName 'Application' -AccountName 'DOMAIN\GroupName' -Access 'Read'
.EXAMPLE
	ControlEventLogPermissions.ps1 -Action 'Revoke' -LogName 'System' -AccountName 'DOMAIN\GroupName' -Access 'ReadWrite' -ComputerName 'REMOTESRVR'
.EXAMPLE
	ControlEventLogPermissions.ps1 -Action 'Grant' -LogName 'Security' -AccountName 'DOMAIN\GroupName' -Access 'Read' -ComputerName 'REMOTESRVR' -UserName 'DOMAIN\Admin' -Password 'SecurePwd'
.EXAMPLE
	ControlEventLogPermissions.ps1 -Action 'Grant' -LogName 'Security' -AccountName 'DOMAIN\GroupName' -Access 'Read' -ComputerNamesFile 'Machines.txt' -UserName 'DOMAIN\Admin' -Password 'SecurePwd'
.NOTES
	Released under The MIT License (MIT)
	Copyright (c) 2015 Thomas F. Abraham (http://www.tfabraham.com)
.LINK
	https://gallery.technet.microsoft.com/scriptcenter
#>

[CmdletBinding()]
Param (
	[Parameter(Mandatory=$true, HelpMessage='Enter Get, Grant or Revoke')]
	[ValidateSet('Get','Grant','Revoke')] 
	[string]$Action,
	[Parameter(Mandatory=$true, HelpMessage='Enter log name')]
	[string]$LogName,
	[Parameter(Mandatory=$true, HelpMessage='Enter local or domain-qualified account name')]
	[string]$AccountName,
	[Parameter(Mandatory=$false, HelpMessage='Enter Read or ReadWrite')]
	[ValidateSet('Read','ReadWrite')] 
	[string]$Access = 'Read',
	[Parameter(Mandatory=$false, HelpMessage='Enter remote computer name')]
	[string]$ComputerName,
	[Parameter(Mandatory=$false, HelpMessage='Enter username for remote computer connection')]
	[string]$UserName,
	[Parameter(Mandatory=$false, HelpMessage='Enter password for remote computer connection')]
	[string]$Password,
	[Parameter(Mandatory=$false, HelpMessage='Enter name of a text file containing computer names to affect, one name per line')]
	[string]$ComputerNamesFile
)

Function ConvertAccountNameToSID {

<#
.SYNOPSIS
	Converts a local or domain account name to the SID
.DESCRIPTION
	Converts a local or domain account name to the SID
.PARAMETER AccountName
	The domain-qualified user or group name
.EXAMPLE
.NOTES
.LINK
	https://gallery.technet.microsoft.com/scriptcenter
#>
	[CmdletBinding()]
	Param (
		[Parameter(Mandatory=$true, HelpMessage='Enter local or domain-qualified account name')]
		[string]$AccountName
	)

	[array]$accountNameParts = $null
	[string]$sid = ''
	[System.Security.Principal.NTAccount]$ntAcct = $null

	# Split the account name to determine if it is domain-qualified
	$accountNameParts = $AccountName.Split("\\")

	# Attempt to convert the account name to a SID
	Write-Host Translating $AccountName to SID...
	if ($accountNameParts.Length -eq 1) {
		$ntAcct = New-Object System.Security.Principal.NTAccount($AccountName)
	}
	else {
		$ntAcct = New-Object System.Security.Principal.NTAccount($accountNameParts[0], $accountNameParts[1])
	}
	try {
		$sid = $ntAcct.Translate([System.Security.Principal.SecurityIdentifier])
	}
	catch {
		Write-Error -Message "Could not resolve account" $AccountName ". Check spelling and domain-qualify if necessary."
		Return
	}
	Write-Host Account $AccountName has SID $sid
	Write-Host

	Return $sid
}

Function ControlEventLogPermissions {

<#
.SYNOPSIS
	Grants or revokes access to an Event Log
.DESCRIPTION
	Controls access to an Event Log
.PARAMETER Action
	The action to take (Get, Grant or Revoke)
.PARAMETER LogName
	The Event Log log name (Application, Security or System)
.PARAMETER AccountName
	The domain-qualified user or group name
.PARAMETER Access
	The type of rights to grant (Read or ReadWrite)
.PARAMETER ComputerName
	The remote computer name (optional)
.PARAMETER UserName
	User name for remote computer login (optional)
.PARAMETER Password
	Password for remote computer login (optional)
.EXAMPLE
.NOTES
.LINK
	https://gallery.technet.microsoft.com/scriptcenter
#>

	[CmdletBinding()]

	Param (
		[Parameter(Mandatory=$true, HelpMessage='Enter Get, Grant or Revoke')]
		[ValidateSet('Get','Grant','Revoke')] 
		[string]$Action,
		[Parameter(Mandatory=$true, HelpMessage='Enter log name')]
		[string]$LogName,
		[Parameter(Mandatory=$true, HelpMessage='Enter local or domain-qualified account name')]
		[string]$AccountName,
		[Parameter(Mandatory=$false, HelpMessage='Enter Read or ReadWrite')]
		[ValidateSet('Read','ReadWrite')] 
		[string]$Access = 'Read',
		[Parameter(Mandatory=$false, HelpMessage='Enter remote computer name')]
		[string]$ComputerName,
		[Parameter(Mandatory=$false, HelpMessage='Enter username for remote computer connection')]
		[string]$UserName,
		[Parameter(Mandatory=$false, HelpMessage='Enter password for remote computer connection')]
		[string]$Password,
		[Parameter(Mandatory=$true, HelpMessage='Enter SID for account')]
		[string]$sid
	)

	[array]$logConfig = ''
	[array]$channelAccessArray = $null
	[array]$remoteParams = $null
	[array]$params = $null
	[string]$channelAccess = ''
	[string]$sddlRights = ''
	[string]$newChannelAccess = ''

	if ($Action -ieq "Grant") {
		Write-Host Grant $AccountName $Access access to log $LogName on $ComputerName ...
	}
	elseif ($Action -ieq "Revoke") {
		Write-Host Revoke $AccountName $Access access to log $LogName on $ComputerName ...
	}
	elseif ($Action -ieq "Get") {
		Write-Host Get current access for $AccountName to log $LogName on $ComputerName ...
	}

	if ($ComputerName -ine '') {
		$remoteParams = @("/r:""$ComputerName""")

		if ($UserName -ine '') {
			$remoteParams += "/u:""$UserName"""

			if ($Password -ine '') {
				$remoteParams += "/p:""$Password"""
			}
		}
	}

	# Get the current configuration of the desired log
	Write-Host "Reading current configuration of log $LogName on $ComputerName..."
	$params = @("gl", "$LogName")
	$params += $remoteParams
	$logConfig = & wevtutil $params

	if ($LASTEXITCODE -ne 0) {
		Write-Error -Message "Failed to read current configuration of log $LogName on $ComputerName"
		Return
	}
	Write-Host "Successfully read current configuration of log $LogName on $ComputerName."

	# Search for the channelAccess (permissions) configuration section
	$channelAccessArray = $logConfig -like "channelAccess:*"

	if ($channelAccessArray.Length -eq 0) {
		Write-Error -Message "Expected to find a string starting with channelAccess. Actual: " $logConfig
		Return
	}

	# Trim off the channelAccess label
	$channelAccess = $channelAccessArray[0].Replace("channelAccess: ","")
	Write-Debug -Message "Current channelAccess for $LogName on $ComputerName is $channelAccess"

	if ($Action -ieq "Grant") {
		# Search for an existing SDDL token using the target SID
		if ($channelAccess -match "(\(\w*\;\w*\;\w*\;\w*\;\w*\;$sid\))") {
			# Remove the existing SDDL token
			$channelAccess = $channelAccess.Replace($matches[0], "")
		}

		# Convert the permissions string to SDDL
		if ($Access -ieq "ReadWrite") {
			$sddlRights = "0x3"
		}
		else {
			$sddlRights = "0x1"
		}

		# Build and append a new SDDL onto the existing SDDL
		$newChannelAccess = $channelAccess + "(A;;" + $sddlRights + ";;;" + $sid + ")"
	}
	elseif ($Action -ieq "Revoke") {
		# Search for an existing SDDL token using the target SID
		if ($channelAccess -match "(\(\w*\;\w*\;\w*\;\w*\;\w*\;$sid\))") {
			# Remove the existing SDDL token
			$newChannelAccess = $channelAccess.Replace($matches[0], "")
		}
		else {
			Write-Host "SID does not exist in channel access string on $ComputerName. Nothing to revoke." -ForegroundColor Yellow
			Return
		}
	}
	elseif ($Action -ieq "Get") {
		# Search for an existing SDDL token using the target SID
		if ($channelAccess -match "(\(\w*\;\w*\;\w*\;\w*\;\w*\;$sid\))") {
			if ($matches[0].Contains("0x3")) {
				Write-Host "$AccountName currently has READ/WRITE access to $LogName on $ComputerName." -ForegroundColor Green
			}
			elseif ($matches[0].Contains("0x1")) {
				Write-Host "$AccountName currently has READ access to log $LogName on $ComputerName." -ForegroundColor Green
			}
			else {
				Write-Host "$AccountName currently has an UNKNOWN access right to log $LogName on $ComputerName." -ForegroundColor Green
			}
		}
		else {
			Write-Host "$AccountName currently has NO access rights to log $LogName on $ComputerName." -ForegroundColor Green
			Return
		}
		Return
	}

	Write-Debug -Message "New channel access string is $newChannelAccess"

	# Write the updated configuration
	Write-Host "Writing new channel access string to log $LogName configuration on $ComputerName ..."
	$params = @("sl", "$LogName", "/ca:$newChannelAccess")
	$params += $remoteParams
	& wevtutil $params
	if ($LASTEXITCODE -ne 0) {
		Write-Error -Message "Failed to write new configuration of log $LogName on $ComputerName"
		Return
	}
	Write-Host "Done writing new configuration of $LogName on $ComputerName." -ForegroundColor Green
}


[hashtable]$scriptParameters = $PSBoundParameters
[array]$computerNamesFileContent
[string]$listComputerName
[string]$sid

$Error.Clear()

Try {
	$sid = ConvertAccountNameToSid -AccountName "$AccountName"

	$scriptParameters['sid'] = $sid
	$scriptParameters.Remove('ComputerNamesFile')

	if ($ComputerNamesFile -ieq '') {
		if ($scriptParameters.ContainsKey("ComputerName") -eq $false) {
			$scriptParameters["ComputerName"] = $env:COMPUTERNAME
		}
		ControlEventLogPermissions @scriptParameters
	}
	else {
		$computerNamesFileContent = Get-Content $ComputerNamesFile
		foreach ($listComputerName in $computerNamesFileContent) {
			$scriptParameters["ComputerName"] = $listComputerName
			ControlEventLogPermissions @scriptParameters
		}
	}
}
Catch {
	Write-Error -Message $Error[0].Exception.Message
}