Add DOMAIN\Domain Admins group as Full Access to the orphaned Home Directory?

问题

The below script was created by the great https://stackoverflow.com/users/9898643/theo to list all orphaned HomeDirectory:

$ServerHomeDirShare = "\\FileServer\HomeDir$"
$filter = "(Enabled -eq 'true')"

# get all user accounts from AD; only SamAccountName required
$users = Get-ADUser -Filter $filter | Select-Object -ExpandProperty SamAccountName
    Get-ChildItem -Path $ServerHomeDirShare -Directory | 
    Where-Object { $users -notcontains ($_.Name -replace '^(\w+\.\w+).*', '$1') } |
    Select-Object -Property Name, FullName,
                  @{ n = 'LastAccessTime'; e = { $_.LastAccessTime.ToString('yyyy-MM-dd HH:mm:ss') } },
                  @{ n = "Directory Size (MB)"; e = {
                            Try {
                                $Size = (Get-ChildItem -Path $_.FullName -Recurse -ErrorAction Stop | 
                                         Measure-Object Length -Sum).Sum / 1MB
                                [math]::Round($Size, 2)
                            }
                            Catch {
                                "ERROR: $($_.Exception.Message)"
                            }
                        }
                    } |
    Export-Csv -NoTypeInformation -Path C:\UserProfilesNotExist-Size.csv

However, there is one more issue that needed fixing, to add DOMAIN\Domain Admins AD group as Full Access to the directory ACL, BUT ONLY when the directory is not accessible or throwing error.

    $FullAccessADGroup = "DOMAIN\Domain Admins"
    
    function Take-Ownership
    {
        param (
            [String]$Folder
        )
        takeown.exe /A /F $Folder
        $CurrentACL = Get-Acl $Folder
        
        write-host "`n`t...Adding NT Authority\SYSTEM to $Folder" -ForegroundColor Yellow
        $SystemACLPermission = "NT AUTHORITY\SYSTEM", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow"
        $SystemAccessRule = new-object System.Security.AccessControl.FileSystemAccessRule $SystemACLPermission
        $CurrentACL.AddAccessRule($SystemAccessRule)
        
        write-host "`t...Adding Infrastructure Services to $Folder" -ForegroundColor Yellow
        $AdminACLPermission = $FullAccessADGroup, "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow"
        $SystemAccessRule = new-object System.Security.AccessControl.FileSystemAccessRule $AdminACLPermission
        $CurrentACL.AddAccessRule($SystemAccessRule)
        
        Set-Acl -Path $Folder -AclObject $CurrentACL
    }
    
function Test-Folder($FolderToTest) {
    $error.Clear()
    $ErrorArray = @()
    Get-ChildItem $FolderToTest -Recurse -ErrorAction SilentlyContinue | Select-Object FullName
    if ($error) {
        $ErrorArray = $error + $ErrorArray
        foreach ($err in $ErrorArray) {
            if ($err.FullyQualifiedErrorId -eq "DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand") {
                Write-Host Unable to access $err.TargetObject -ForegroundColor Red
                Write-Host Attempting to take ownership of $err.TargetObject -ForegroundColor Yellow
                Take-Ownership($err.TargetObject)
                Test-Folder($err.TargetObject)
            }
        }
    }
}

Test-Folder $source

Because even though I am using DOMAIN\Administrator account to execute the script above, I cannot get the directory size or even opened the directory via the UNCPath, this is the error:

ERROR: Access to the path '\\FileServer\HomeDir$\Jane.Liz.V2' is denied.
ERROR: Access to the path '\\FileServer\HomeDir$\Lisa.Chan.V5' is denied.
ERROR: Access to the path '\\FileServer\HomeDir$\Carolline.Marce.V6' is denied.
...

来源：https://stackoverflow.com/questions/62409598/add-domain-domain-admins-group-as-full-access-to-the-orphaned-home-directory