Update projektplan and TODO with share analysis results

- projektplan: status section (server delivered, driver done), share analysis results in §2.1, customer checklist answers in §2.2, storage resolved in §2.3, new §2.6 on scoping the corpus, updated risks - scripts/list-shares.ps1: enumerate SMB shares incl. paths, permissions and DFS namespaces on the file server - TODO.md: restructured into blocking/server/done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-09-03 14:10:14 +02:00
parent e7ef29c5d5
commit be6efa7b34
3 changed files with 243 additions and 38 deletions
@@ -0,0 +1,100 @@
+<#
+.SYNOPSIS
+    Lists all SMB shares of a Windows file server incl. local path, size and
+    permissions — the basis for the include/exclude decision (projektplan §2.6).
+
+.DESCRIPTION
+    Run ON the file server (or against a remote one via -ComputerName). Reports
+    per share: name, local path, description, share-level permissions, NTFS
+    groups, plus optional size/file count. Admin shares (C$, ADMIN$, IPC$) are
+    skipped unless -IncludeAdminShares is given.
+
+    Purely read-only. Requires local admin for Get-SmbShare (part of Windows
+    Server, no extra module needed).
+
+.EXAMPLE
+    .\list-shares.ps1
+
+.EXAMPLE
+    # remote, and with size per share (slow on large shares)
+    .\list-shares.ps1 -ComputerName Z-FILESERVER -WithSize
+#>
+param(
+    [string]$ComputerName = $env:COMPUTERNAME,
+    [switch]$IncludeAdminShares,
+    [switch]$WithSize,
+    [string]$OutDir = (Join-Path (Get-Location) "share-list")
+)
+
+$ErrorActionPreference = 'Continue'
+New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
+
+Write-Host "=== SMB shares on $ComputerName ===" -ForegroundColor Cyan
+
+$shares = Get-SmbShare -CimSession $ComputerName -ErrorAction Stop
+if (-not $IncludeAdminShares) {
+    $shares = $shares | Where-Object { -not $_.Name.EndsWith('$') }
+}
+
+$result = foreach ($sh in $shares) {
+    Write-Host ("  {0,-25} {1}" -f $sh.Name, $sh.Path)
+
+    # share-level permissions
+    $sharePerms = try {
+        (Get-SmbShareAccess -Name $sh.Name -CimSession $ComputerName -ErrorAction Stop |
+            ForEach-Object { "$($_.AccountName)=$($_.AccessRight)" }) -join '; '
+    } catch { 'n/a' }
+
+    # NTFS permissions (top level only) — who actually has access
+    $ntfsPerms = try {
+        $uncPath = "\\$ComputerName\$($sh.Name)"
+        ((Get-Acl -LiteralPath $uncPath -ErrorAction Stop).Access |
+            ForEach-Object { "$($_.IdentityReference)=$($_.FileSystemRights)" } |
+            Select-Object -Unique | Select-Object -First 10) -join '; '
+    } catch { 'n/a' }
+
+    $sizeGB = $null; $fileCount = $null
+    if ($WithSize) {
+        Write-Host "    measuring size ..." -ForegroundColor DarkGray
+        try {
+            $m = Get-ChildItem -LiteralPath "\\$ComputerName\$($sh.Name)" -Recurse -File -Force -ErrorAction SilentlyContinue |
+                 Measure-Object -Property Length -Sum
+            $sizeGB    = [Math]::Round($m.Sum / 1GB, 2)
+            $fileCount = $m.Count
+        } catch { }
+    }
+
+    [PSCustomObject]@{
+        Name             = $sh.Name
+        Path             = $sh.Path
+        Description      = $sh.Description
+        SharePermissions = $sharePerms
+        NtfsPermissions  = $ntfsPerms
+        SizeGB           = $sizeGB
+        FileCount        = $fileCount
+    }
+}
+
+$csv = Join-Path $OutDir "smb-shares.csv"
+$result | Export-Csv $csv -NoTypeInformation -Encoding UTF8
+$result | Format-Table Name, Path, SizeGB, FileCount -AutoSize
+
+# DFS namespaces (if used) — often the path users actually see
+Write-Host "`n=== DFS namespaces ===" -ForegroundColor Cyan
+try {
+    $roots = Get-DfsnRoot -ErrorAction Stop
+    if ($roots) {
+        $dfs = foreach ($r in $roots) {
+            Get-DfsnFolder -Path "$($r.Path)\*" -ErrorAction SilentlyContinue | ForEach-Object {
+                $t = Get-DfsnFolderTarget -Path $_.Path -ErrorAction SilentlyContinue
+                [PSCustomObject]@{ DfsPath = $_.Path; Targets = ($t.TargetPath -join '; ') }
+            }
+        }
+        $dfs | Export-Csv (Join-Path $OutDir "dfs-namespaces.csv") -NoTypeInformation -Encoding UTF8
+        $dfs | Format-Table -AutoSize
+    } else { Write-Host "  none" }
+} catch {
+    Write-Host "  no DFS role / not available on this host"
+}
+
+Write-Host "`nResults in: $OutDir" -ForegroundColor Green