You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Lounge » NTFS Ramblings
Register User       Forum List       Calendar       FAQ
Page 1 of 1 1
Topic Options
#185003 - 2008-02-01 10:08 AM NTFS Ramblings
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
As some of you know I invest waaaay too much time in NTFS permissions.
Recent findings show that I stumbled on yet another problem.
If you used my NTFSPerms UDF you're likely to to have stumbled upon the same problem settings security permissions on folders. While the udf works fine on files, folders are another issue. Especially when you want to have your new perms propagated down the food chain. Normally (my UDF does this by default) you set the aceflag to 3, which means 1 (for object inherit) + 2 (container inherit). This works fine and dandy for subfolders you create afterwards but not for the existing subfolders.

Apparantly this has to do with the Security Descriptor Control Flags.
This is a whole new ballpark. As the AdsSecurityUtility (which I use in my SharePerms and NTFSPerms) allows for pretty much everything in a SD to be edited this is the only thing seemingly it does not allow to edit, however you can read the control flags and here comes the curious part. When you create a folder and the NTFS perms are default (IE not edited and the upper folders not edited as well) this Flag will most likely be 33796 which means SE_SACL_PRESENT and SE_DACL_AUTO_INHERITED. This is basically always what you want. (unless you have different ideas about inheritance).

As soon as you apply your new ace to the folder the Control Flag changes, so it can be changed you ask ?, yes and no. It changes it for you and drops the SE_DACL_AUTO_INHERITED flag. You can not (not to my knowledge...) change the control flag back. So existing subfolders do not get your new permissions inherited, off course you could make a script that applies the new ace to each subfolder and file but this is not how it should be done imo.

Here comes the curious bit, if you CREATE a new subfolder, the new aces are inherited!!! now thats strange isn't it ?

There is a workaround to have control flags set back properly to the root folder that you wanted your ace to be added, you can set the control flags with a vbs script \:\( This is because there is a WMI object that allows you to do just that, it makes use of a Reference Variable, something KiX does not allow, KiX only support Optional Variables for UDF's.

So basically with all my ramblings aside there is a question in here \:\)
Does anyone know how to use AdsSecurityUtility to SET control flags?

As always thanks for taking the time to read my ramblings \:\)
Top
#185006 - 2008-02-01 10:16 AM Re: NTFS Ramblings [Re: Arend_]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
Text removed, post below contains better code

Edited by apronk (2009-01-05 10:18 AM)
Edit Reason: Removed text
Top
#185013 - 2008-02-01 11:24 AM Re: NTFS Ramblings [Re: Arend_]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
 Originally Posted By: apronk
As some of you know I invest waaaay too much time in NTFS permissions.


Not really. It sure helps one to learn the inner workings of things much better and assist others at the same time. Thanks for taking the time.
Top
#185020 - 2008-02-01 03:28 PM Re: NTFS Ramblings [Re: NTDOC]
Bryce Offline
KiX Supporter
*****

Registered: 2000-02-29
Posts: 3167
Loc: Houston TX
what you just described is the behavior of the GUI tools too. and the reason there is a

"replace permission entries on all child objects with entries shows here that apply to child objects"

Remember it is completely legal to have sub folders that contain different permissions than their parent folder, and even if they are inheriting their permissions, they can have "extra" permissions that the parent folder does not have.
Top
#185024 - 2008-02-01 03:58 PM Re: NTFS Ramblings [Re: Bryce]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
I know, but it is exactly that I want the existing subfolder to inherit the new ace that I apply to the root folder (not just newly created subfolder. This can be done by setting SE_DACL_AUTO_INHERIT flag on de Security Descriptor.
Top
#185060 - 2008-02-04 11:12 AM Re: NTFS Ramblings [Re: Arend_]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
2 Days and I found part of the solution.
As soon as you apply the security descriptor it "AdsSecurityUtility" removes the SE_DACL_AUTO_INHERIT flag. Reapplying this flag with the afore mentioned VBS solves the problem completely. I found that partly this can be done with AdsSecurityUtility. Before you apply the Security Descriptor back to the folder add SE_DACL_AUTO_INHERIT_REQ flag to it.
 Code:
$sd.Control = $sd.Control + &100

This will set everything on the folder back to how it should have been, however the problem remains that the existing subfolders don't inherit the new ace. When you set the sd.Control flags using wmi and vbs the existing subfolders do inherit the new ace....

Thanks to M$ for properly documenting AdsSecurityUtility!.... NOT!!!! :P
Top
#185061 - 2008-02-04 11:53 AM Re: NTFS Ramblings [Re: Arend_]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
Found out why it's not working, apparantly Microsoft documented this for it's previous AdsSecurity COM object:
 Originally Posted By: Microsoft

The reason that you cannot use ADSI to set ACEs to propagate down to existing files and folders is because ADSSecurity.dll uses the low-level SetFileSecurity function to set the security descriptor on a folder. There is no flag that can be set by using SetFileSecurity to automatically propagate the ACEs down to existing files and folders. The SE_DACL_AUTO_INHERIT_REQ control flag will only set the SE_DACL_AUTO_INHERITED flag in the security descriptor that is associated with the folder.

Automatic propagation of inheritable ACEs is done only when using the high-level SetSecurityInfo or SetNamedSecurityInfo function. These functions propagate the inheritable ACEs (CONTAINER_INHERIT_ACE or OBJECT_INHERIT_ACE) set on a folder to all existing subfolders and files, as long as the child object's DACL is not SE_DACL_PROTECTED. This is done only in the high-level access control implementation by enumerating the subfolders as well as files, and applying all of the inheritable ACEs.

So this does not mean it cannot be done, you just have to manually apply the aces down the foodchain yourself, the only different you will have to make is to set the AceFlags property to 19 (this folder, subfolders and files inherited) instead of 3 (this folder, subfolders and files) which you apply to the root folder.

Or use VBS to apply the Control Flag.... but as I hate to use VBS for me that is not an option however I will provide the code on how to do it.
be aware that the aforementioned quote applies to AdsSecurity and not to WMI, apparantly WMI uses a high-level SetFileSecurity function.

 Code:
str_path = "D:\test"
Set objSecurity = GetObject("winmgmts:{(Security,Restore)}\\.\root\cimv2:Win32_LogicalFileSecuritySetting='" & str_path & "'")
'Get the Security Descriptor object
objSecurity.GetSecurityDescriptor objSD
objSD.ControlFlags = 33796
'Write back the Security Descriptor
j=objSecurity.SetSecurityDescriptor(objSD)


Or wait till Ruud will implement OUT parameters to KiX (not likely but I'm still hoping).
Top
#185071 - 2008-02-05 12:04 AM Re: NTFS Ramblings [Re: Arend_]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
doesn't seem to be high on his list...
_________________________
!

download KiXnet

Top
#191566 - 2009-01-03 09:20 PM Re: NTFS Ramblings [Re: Lonkero]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
Addition, the quote I made earlier is from this knowledge base article.

Also, here you can find all DACL and SACL properties.
Top
#191595 - 2009-01-05 10:15 AM Re: NTFS Ramblings [Re: Arend_]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
I've written a couple of functions to get info from the Security Descriptor. This will help people who are also interested in NTFS permissions.

This function will show which Control Flags are in the security descriptor of the file or folder you want to check.
Usage: ShowSecurityDescriptor("C:\Windows")
 Code:
Function ShowSecurityDescriptor($strFolder)
  Dim $objADSU, $objSD
  $objADSU = CreateObject("ADsSecurityUtility")
  $objSD = $objADSU.GetSecurityDescriptor($strFolder,1, 1)

? "Control: "+$objSD.Control+" (&"+DecToHex($objSD.Control)+")"
  If ($objSD.Control & &1) = &1
    ? "-SE_OWNER_DEFAULTED" + "                           (Hex: &"+1+")       (Dec: "+CStr(&1)+")"
  EndIf
  If ($objSD.Control & &2) = &2
    ? "-SE_GROUP_DEFAULTED" + "                           (Hex: &"+2+")       (Dec: "+CStr(&2)+")"
  EndIf
  If ($objSD.Control & &4) = &4
    ? "-SE_DACL_PRESENT" + "                              (Hex: &"+4+")       (Dec: "+CStr(&4)+")"
  EndIf
  If ($objSD.Control & &8) = &8
    ? "-SE_DACL_DEFAULTED" + "                            (Hex: &"+8+")       (Dec: "+CStr(&8)+")"
  EndIf
  If ($objSD.Control & &10) = &10
    ? "-SE_SACL_PRESENT" + "                              (Hex: &"+10+")      (Dec: "+CStr(&10)+")"
  EndIf
  If ($objSD.Control & &20) = &20
    ? "-SE_SACL_DEFAULTED" + "                            (Hex: &"+20+")      (Dec: "+CStr(&20)+")"
  EndIf
  If ($objSD.Control & &100) = &100
    ? "-SE_DACL_AUTO_INHERIT_REQ" + "                     (Hex: &"+100+")     (Dec: "+CStr(&100)+")"
  EndIf
  If ($objSD.Control & &200) = &200
    ? "-SE_SACL_AUTO_INHERIT_REQ" + "                     (Hex: &"+200+")     (Dec: "+CStr(&200)+")"
  EndIf
  If ($objSD.Control & &400) = &400
    ? "-SE_DACL_AUTO_INHERITED" + "                       (Hex: &"+400+")     (Dec: "+CStr(&400)+")"
  EndIf
  If ($objSD.Control & &800) = &800
    ? "-SE_SACL_AUTO_INHERITED" + "                       (Hex: &"+800+")     (Dec: "+CStr(&800)+")"
  EndIf
  If ($objSD.Control & &1000) = &1000
    ? "-SE_DACL_PROTECTED" + "                            (Hex: &"+1000+")    (Dec: "+CStr(&1000)+")"
  EndIf
  If ($objSD.Control & &2000) = &2000
    ? "-SE_SACL_PROTECTED" + "                            (Hex: &"+2000+")    (Dec: "+CStr(&2000)+")"
  EndIf
  If ($objSD.Control & &8000) = &8000
    ? "-SE_SELF_RELATIVE" + "                             (Hex: &"+8000+")    (Dec: "+CStr(&8000)+")"
  EndIf
EndFunction


This will show the Ace properties of the specified user.
Usage: ShowACL("C:\Windows","Domain\User")
 Code:
Function ShowACL($strFolder, $strAce)
  Dim $objADSU, $objSD, $objDACL, $objAce
  $objADSU = CreateObject("ADsSecurityUtility")
  $objSD = $objADSU.GetSecurityDescriptor($strFolder,1, 1)
  $objdacl = $objSD.DiscretionaryAcl
  For Each $objAce in $objDACL
    If $objAce.Trustee = $strAce
    ? " AceFlags: "+$objAce.AceFlags+" (&"+DecToHex($objAce.AceFlags)+")"
    If ($objAce.AceFlags & &1) = &1
      ? " -OBJECT_INHERIT_ACE" + "                        (Hex: &"+1+")       (Dec: "+CStr(&1)+")"
    EndIf
    If ($objAce.AceFlags & &2) = &2
      ? " -CONTAINER_INHERIT_ACE" + "                     (Hex: &"+2+")       (Dec: "+CStr(&2)+")"
    EndIf
    If ($objAce.AceFlags & &4) = &4
      ? " -NO_PROPAGATE_INHERIT_ACE" + "                  (Hex: &"+4+")       (Dec: "+CStr(&4)+")"
    EndIf
    If ($objAce.AceFlags & &8) = &8
      ? " -INHERIT_ONLY_ACE" + "                          (Hex: &"+8+")       (Dec: "+CStr(&8)+")"
    EndIf
    If ($objAce.AceFlags & &10) = &10
      ? " -INHERITED_ACE" + "                             (Hex: &"+10+")      (Dec: "+CStr(&10)+")"
    EndIf
    ?
    ? " AccessMask: "+$objAce.AccessMask+" (&"+DecToHex($objAce.AccessMask)+")"
    If ($objAce.AccessMask & &1) = &1
      ? " -FILE_READ_DATA Or FILE_LIST_DIRECTORY" + "     (Hex: &"+1+")       (Dec: "+CStr(&1)+")"
    EndIf
    If ($objAce.AccessMask & &2) = &2
      ? " -FILE_WRITE_DATA or FILE_ADD_FILE" + "          (Hex: &"+2+")       (Dec: "+CStr(&2)+")"
    EndIf
    If ($objAce.AccessMask & &4) = &4
      ? " -FILE_APPEND_DATA or FILE_ADD_SUBDIRECTORY" + " (Hex: &"+4+")       (Dec: "+CStr(&4)+")"
    EndIf
    If ($objAce.AccessMask & &8) = &8
      ? " -FILE_READ_EA" + "                              (Hex: &"+8+")       (Dec: "+CStr(&8)+")"
    EndIf
    If ($objAce.AccessMask & &10) = &10
      ? " -FILE_WRITE_EA" + "                             (Hex: &"+10+")      (Dec: "+CStr(&10)+")"
    EndIf
    If ($objAce.AccessMask & &20) = &20
      ? " -FILE_EXECUTE or FILE_TRAVERSE" + "             (Hex: &"+20+")      (Dec: "+CStr(&20)+")"
    EndIf
    If ($objAce.AccessMask & &40) = &40
      ? " -FILE_DELETE_CHILD" + "                         (Hex: &"+40+")      (Dec: "+CStr(&40)+")"
    EndIf
    If ($objAce.AccessMask & &80) = &80
      ? " -FILE_READ_ATTRIBUTES" + "                      (Hex: &"+80+")      (Dec: "+CStr(&80)+")"
    EndIf
    If ($objAce.AccessMask & &100) = &100
      ? " -FILE_WRITE_ATTRIBUTES" + "                     (Hex: &"+100+")     (Dec: "+CStr(&100)+")"
    EndIf
    If ($objAce.AccessMask & &10000) = &10000
      ? " -DELETE" + "                                    (Hex: &"+10000+")   (Dec: "+CStr(&10000)+")"
    EndIf
    If ($objAce.AccessMask & &20000) = &20000
      ? " -READ_CONTROL" + "                              (Hex: &"+20000+")   (Dec: "+CStr(&20000)+")"
    EndIf
    If ($objAce.AccessMask & &40000) = &40000
      ? " -WRITE_DAC" + "                                 (Hex: &"+40000+")   (Dec: "+CStr(&40000)+")"
    EndIf
    If ($objAce.AccessMask & &80000) = &80000
      ? " -WRITE_OWNER" + "                               (Hex: &"+80000+")   (Dec: "+CStr(&80000)+")"
    EndIf
    If ($objAce.AccessMask & &100000) = &100000
      ? " -SYNCHRONIZE" + "                               (Hex: &"+100000+")  (Dec: "+CStr(&100000)+")"
    EndIf
    ?
    ? " AceType: "+$objAce.AceType+" (&"+DecToHex($objAce.AceType)+")"
    If ($objAce.AceFlags & &0) = &0
      ? " -Access Allowed" + "                            (Hex: &"+0+")       (Dec: "+CStr(&0)+")"
    EndIf
    If ($objAce.AceFlags & &1) = &1
      ? " -Access Denied" + "                             (Hex: &"+1+")       (Dec: "+CStr(&1)+")"
    EndIf
    If ($objAce.AceFlags & &2) = &2
      ? " -Audit" + "                                     (Hex: &"+2+")       (Dec: "+CStr(&2)+")"
    EndIf
    ?
    ? " Flags:"+$objAce.Flags
    ?
    EndIf
  Next
EndFunction

Top
#191624 - 2009-01-05 09:20 PM Re: NTFS Ramblings [Re: Arend_]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Thanks for sharing. Sooner or later maybe you'll get it all working and scriptable as it should be, hopefully Ruud will come through on some additions.
Top
#191662 - 2009-01-06 08:51 AM Re: NTFS Ramblings [Re: NTDOC]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
Already got it working, I'll update the UDF as soon as possible.
I've written a proper workaround, only problem with it is that it takes a long time to recurse trough subfolders and files if there are a lot of them.

If Ruud comes through that will save drastic amounts of time.
Top
#194992 - 2009-07-23 06:51 PM Re: NTFS Ramblings [Re: Arend_]
Gargoyle Offline
MM club member
*****

Registered: 2004-03-09
Posts: 1597
Loc: Valley of the Sun (Arizona, US...
Well I knew that I was going to be using this UDF one day, but I have not seen how to specify to reset every file and folder under the "root" folder.

And many thanks Apronk for making my life much easier with this work.
_________________________
Today is the tomorrow you worried about yesterday.

Top
#195096 - 2009-07-29 10:59 AM Re: NTFS Ramblings [Re: Gargoyle]
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
Yeah the resetting is the problem still. It requires High Level security setting of the DACL :-(

I did find a way to apply it as the VBS code does. To put it in better words I have translated the VBS code in a way KiX can handle it. Unfortunately it does not reset the DACL as I thought.

 Code:
  ;Set HighLevel Security Control Flag
  Dim $objSecurity, $objMethod, $objInParam
  ReDim $objSD
  $objSecurity = GetObject("winmgmts:{(Security,Restore)}\\.\root\cimv2:Win32_LogicalFileSecuritySetting='"+$strObject+"'")
  $objSD = $objSecurity.ExecMethod_("GetSecurityDescriptor").Descriptor
  $objSD.ControlFlags = $objSD.ControlFlags + &400
  $objMethod = $objSecurity.Methods_("SetSecurityDescriptor")
  $objInParam = $objMethod.inParameters.SpawnInstance_()
  $objInParam.Properties_.item("Descriptor").Value = $objSD
  $=$objSecurity.ExecMethod_("SetSecurityDescriptor",$objInParam)


$strObject would be the folder.
Top
#195101 - 2009-07-29 03:05 PM Re: NTFS Ramblings [Re: Arend_]
Gargoyle Offline
MM club member
*****

Registered: 2004-03-09
Posts: 1597
Loc: Valley of the Sun (Arizona, US...
Many thanks again.
_________________________
Today is the tomorrow you worried about yesterday.

Top
Page 1 of 1 1


Moderator:  Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 2870 anonymous users online.
details
Newest Members
fgarcia, Viginette, ManuvdWielNL, Sir_Barrington, batdk82
17889 Registered Users
My Cookies · Mark all read Powered by UBB.threads™ Contact Us · KiXtart.org website · Top

Generated in 0.107 seconds in which 0.066 seconds were spent on a total of 13 queries. Zlib compression enabled.
Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org