Can you review and comment on - http://www.oregonclassifieds.net/cgi-local/ib3/ikonboard.cgi?s=3c233b8002f4072c; act=ST;f=5;t=2

?

Thanks!

- Kent

[ 09 August 2001: Message edited by: kdyer ]

[ 21 December 2001: Message edited by: kdyer ]

Amazing - this is the first script (I've) ever seen that sets ACL's through COM.

One of the biggest short-commings of the ADSI WinNT service provider model is the lack of ACL support. MS always said they'd include it in a future release. Reading the comments - I get the impression that "ADsSecurity" is that extra snapin (wonder it they'll be rolling this into ADSI proper) ? Has ADsSecurity been out for long ?

Downloading ...

Any plans for a KiX port ?

-Shawn

Yeah, but I am not really happy with it in it's present state. I would like to set the share perms as well as the file/folder perms. It appears that there are two different sets of ACLs - file/folder and share.

Anyway, I was hoping that you had some insight to this.

I just threw this together because our Admins have to remote to different servers create a new folder, and apply perms and this can be very time-consuming. A Kixtart "port" could be done, but right now I am kinda slammed with other projects. For now, I am pretty green when it comes to WSH and ADSI.

ADSI Security I don't know too much about. I had to scour pretty hard to find this. Actually, the info I did find was in front of me the whole time on with the following post - http://cwashington.netreach.net/script_repository/view_scripts.asp?Index=360&ScriptType=vbscript

Thanks,

- Kent

[ 10 August 2001: Message edited by: kdyer ]

ADsSecurity is news to me !

I haven't had a chance to dig deep into your script (or your links) - so are you saying that one can set share perms with it - or your not sure ?

-Shawn

That is, ACL Editing without XACLS.EXE!

Cool!

- Kent

Thanks for totally ruining my evening - I've been obsorbed with this ADSI reskit - it's wonderfull - going to play - not alot of information out there - head hurts - eyes weary...

By the way - regobj.dll will now allow us to set registry ACLS with KiXtart !!!

I'm going back in ...

-Shawn

It's 11:30 pm my time and still poking around the internet trying to get the scoop on this stuff - after an exhaustive search of the literature (what little there is) - here's thoughts :

1) ADsSecurity cannot set share permissions. It can only change file,folder and registry ACL's. Is this your conclusion as well ?

2) I downloaded the latest and greatest ADSI SDK and it stills states that share permissioning is not implemented "yet"

3) I guess RMTSHARE is still the best bet for permissioning shares through scripts ?

4) Permissioning registry ACL's through ADsSecurity would be a facinating topic to pursue (especially given some recent posts and that there are no (known) tools to do this job) ... thoughts ?

-Shawn

I've been hacking around with ADsSecurity and came-up with this script. It's basically a rip from what little i've found on the net ...

This script will enumerate all access control entries ($ace) in a Registry ACL ($dacl) :

code:

---

break on

$KEY = "HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT" ; change this key to whatever

$RIGHT_REG_READ = &20019
$RIGHT_REG_FULL = &F003F

$sec = createobject("ADsSecurity")
if $sec
 $sd = $sec.GetSecurityDescriptor("RGY://\$key" )
 if $sd
  ?"$key"?
  $dacl = $sd.DiscretionaryAcl
  if $dacl
   for each $ace in $dacl
    ? $ace.trustee
    select
     case $ace.accessmask = $RIGHT_REG_READ
      " (read)"
     case $ace.accessmask = $RIGHT_REG_FULL
      " (full control)"
     case 1
      " (special)"
    endselect
   next
   $dacl=0
  endif
  $sd=0
 endif
 $sec=0
else
 ?"ADsSecurity not installed on this machine"
endif

exit

---

Just an fyi - never now what might come in handy one day ?

This script just scratches the surface of what ADsSecurity's all about (obviously). In terms of registry security - there's alot more granularity one can get into (query/set/delete/etc). But I imagine that ADsSecurity's file/folder permissioning feature is the big seller - eh ?

-Shawn

[ 10 August 2001: Message edited by: Shawn ]

I hope you are not in the dog house again!! I know that my wife states that I am married to these projects and work rather than her.

Sorry about killing your evening.

I will see about contacting that guy who coded that WSH today. I was on MSDN pretty heavily yesterday and no joy in finding ability to set share perms. It really looks like he took the info on MSDN for Exchange Setup and tweaked it for file shares.

I talked with one of my colleagues and he told me the way it was setup now is acceptable. I just wanted it right! His comment was that the security is fine if someone else could not get to the folders/files of another Employee, for example.

I will look into at the RMTSHARE util.

I have tried using Cluster Admin for creating shares, it was painfully slow and cumbersome to use on our WAN. ADSI is quick and we can get stuff done in a reasonable period of time.

Now, I have to go finish my SCAN...ENDSCAN COM Object Project for VFP. They have only been asking for results for a while now.. Oops! You have given me inspiration and have made others in my group very happy! Thanks..

L8r,

- Kent

Well here is a VBS script from Microsoft that replaces the XCACLS program that has problems with the inheritence feature in Windows 2000. Does not look like it does anything with SHARE permissions though.

code:

---

 '***********************************************************************************
'*
'* File:		XCACLS.VBS
'* Created:		April 18, 2001
'* Last Modified:	August 6, 2001
'* Version:		1.7
'*
'* Main Function:  List/Change ACLS for files and directories
'*
'*
'* Copyright (C) 2001 Microsoft Corporation
'* 
'* Written by D Burrell
'*
'***********************************************************************************
OPTION EXPLICIT
'********************************************************************
'* Declare main variables
'********************************************************************
    Dim intOpMode, blnQuiet, strOutputFile, objOutputFile, debug_on
    Dim a_Used, t_Used, e_Used, g_Used, r_used
    Dim p_Used, d_used, i_used, o_used, filename_var
    Dim l_Used, q_Used, debug_Used, strDefaultDomain, strSystemDomainSid, strSystemDomainName, intPermUpdateCount
    Dim g_var_User(), ObjTrustee_g_var_User(), g_Var_Perm(), g_Var_Spec()
    dim r_Var_User(), ObjTrustee_r_var_User()
    Dim p_var_User(), ObjTrustee_p_var_User(), p_Var_Perm(), p_Var_Spec()
    Dim d_Var_User(), ObjTrustee_d_var_User(), d_Var_Perm(), d_Var_Spec()
    ReDim g_var_User(0), ObjTrustee_g_var_User(0), g_Var_Perm(0), g_Var_Spec(0)
    Redim r_Var_User(0), ObjTrustee_r_var_User(0)
    ReDim p_var_User(0), ObjTrustee_p_var_User(0), p_Var_Perm(0), p_Var_Spec(0)
    ReDim d_Var_User(0), ObjTrustee_d_var_User(0), d_Var_Perm(0), d_Var_Spec(0)
    Dim i_Var, o_Var
    Dim fso, InitialfilenameAbsPath, QryBaseNameHasWildcards, QryExtensionHasWildcards
    Dim objService, objLocalService, objLocator
    Dim strRemoteServerName, strRemoteShareName, strRemoteUserName, strRemotePassword
    Dim RemoteServer_Used, RemoteUserName_Used
    Dim DisplayDirPath, ActualDirPath
    'This const value is for any use referenced without a domain, if this is TRUE, we will use the local machine name
    'for the domain if its a non-dc. For DC's we will always use the Domain name unless you specify the actual domain to use.
    'If this is FALSE, we will default to the Domain name.
    CONST CONST_USE_LOCAL_FOR_NON_DCs          	= TRUE
    'These are specific to this Script 
    CONST CONST_SHOW_USAGE              	= 3
    CONST CONST_PROCEED                 	= 4 
    CONST CONST_ERROR	                 	= 1
    'When working with NTFS Security, we use constants that match the API documentation
    '********************* ControlFlags *********************
    CONST ALLOW_INHERIT  			= 33796		'Used in ControlFlag to turn on Inheritance
								'Same as: 
								'SE_SELF_RELATIVE + SE_DACL_AUTO_INHERITED + SE_DACL_PRESENT
    CONST DENY_INHERIT   			= 37892		'Used in ControlFlag to turn off Inheritance
								'Same as: 
								'SE_SELF_RELATIVE + SE_DACL_PROTECTED + SE_DACL_AUTO_INHERITED + SE_DACL_PRESENT
    Const SE_OWNER_DEFAULTED 			= 1		'A default mechanism, rather than the the original provider of the security 
								'descriptor, provided the security descriptor's owner security identifier (SID). 
    Const SE_GROUP_DEFAULTED 			= 2		'A default mechanism, rather than the the original provider of the security
								'descriptor, provided the security descriptor's group SID. 
    Const SE_DACL_PRESENT 			= 4		'Indicates a security descriptor that has a DACL. If this flag is not set, 
								'or if this flag is set and the DACL is NULL, the security descriptor allows 
								'full access to everyone.
    Const SE_DACL_DEFAULTED 			= 8		'Indicates a security descriptor with a default DACL. For example, if an 
								'object's creator does not specify a DACL, the object receives the default 
								'DACL from the creator's access token. This flag can affect how the system 
								'treats the DACL, with respect to ACE inheritance. The system ignores this 
								'flag if the SE_DACL_PRESENT flag is not set. 
    Const SE_SACL_PRESENT 			= 16		'Indicates a security descriptor that has a SACL. 
    Const SE_SACL_DEFAULTED 			= 32		'A default mechanism, rather than the the original provider of the security 
								'descriptor, provided the SACL. This flag can affect how the system treats 
								'the SACL, with respect to ACE inheritance. The system ignores this flag if 
								'the SE_SACL_PRESENT flag is not set. 
    Const SE_DACL_AUTO_INHERIT_REQ 		= 256		'Requests that the provider for the object protected by the security descriptor 
								'automatically propagate the DACL to existing child objects. If the provider 
								'supports automatic inheritance, it propagates the DACL to any existing child 
								'objects, and sets the SE_DACL_AUTO_INHERITED bit in the security descriptors 
								'of the object and its child objects.
    Const SE_SACL_AUTO_INHERIT_REQ 		= 512		'Requests that the provider for the object protected by the security descriptor 
								'automatically propagate the SACL to existing child objects. If the provider 
								'supports automatic inheritance, it propagates the SACL to any existing child 
								'objects, and sets the SE_SACL_AUTO_INHERITED bit in the security descriptors of 
								'the object and its child objects.
    Const SE_DACL_AUTO_INHERITED 		= 1024		'Windows 2000 only. Indicates a security descriptor in which the DACL is set up 
								'to support automatic propagation of inheritable ACEs to existing child objects. 
								'The system sets this bit when it performs the automatic inheritance algorithm 
								'for the object and its existing child objects. This bit is not set in security 
								'descriptors for Windows NT versions 4.0 and earlier, which do not support 
								'automatic propagation of inheritable ACEs.
    Const SE_SACL_AUTO_INHERITED 		= 2048		'Windows 2000: Indicates a security descriptor in which the SACL is set up to 
								'support automatic propagation of inheritable ACEs to existing child objects. 
								'The system sets this bit when it performs the automatic inheritance algorithm 
								'for the object and its existing child objects. This bit is not set in security 
								'descriptors for Windows NT versions 4.0 and earlier, which do not support automatic 
								'propagation of inheritable ACEs.
    Const SE_DACL_PROTECTED 			= 4096		'Windows 2000: Prevents the DACL of the security descriptor from being modified 
								'by inheritable ACEs. 
    Const SE_SACL_PROTECTED 			= 8192		'Windows 2000: Prevents the SACL of the security descriptor from being modified 
								'by inheritable ACEs. 
    Const SE_SELF_RELATIVE 			= 32768		'Indicates a security descriptor in self-relative format with all the security 
								'information in a contiguous block of memory. If this flag is not set, the security 
								'descriptor is in absolute format. For more information, see Absolute and 
								'Self-Relative Security Descriptors in the Platform SDK topic Low-Level Access-Control.
    '********************* ACE Flags *********************
    CONST OBJECT_INHERIT_ACE  			= 1 	'Noncontainer child objects inherit the ACE as an effective ACE. For child 
							'objects that are containers, the ACE is inherited as an inherit-only ACE 
							'unless the NO_PROPAGATE_INHERIT_ACE bit flag is also set.
    CONST CONTAINER_INHERIT_ACE 		= 2 	'Child objects that are containers, such as directories, inherit the ACE
							'as an effective ACE. The inherited ACE is inheritable unless the 
							'NO_PROPAGATE_INHERIT_ACE bit flag is also set.  
    CONST NO_PROPAGATE_INHERIT_ACE 		= 4 	'If the ACE is inherited by a child object, the system clears the 
							'OBJECT_INHERIT_ACE and CONTAINER_INHERIT_ACE flags in the inherited ACE. 
							'This prevents the ACE from being inherited by subsequent generations of objects.  
    CONST INHERIT_ONLY_ACE	 		= 8 	'Indicates an inherit-only ACE which does not control access to the object
							'to which it is attached. If this flag is not set, the ACE is an effective
							'ACE which controls access to the object to which it is attached. Both 
							'effective and inherit-only ACEs can be inherited depending on the state of
							'the other inheritance flags. 
    CONST INHERITED_ACE		 		= 16 	'Windows NT 5.0 and later, Indicates that the ACE was inherited. The system sets
							'this bit when it propagates an inherited ACE to a child object. 
    CONST ACEFLAG_VALID_INHERIT_FLAGS 		= 31 	'Indicates whether the inherit flags are valid.  

    'Two special flags that pertain only to ACEs that are contained in a SACL are listed below. 
    CONST SUCCESSFUL_ACCESS_ACE_FLAG 		= 64 	'Used with system-audit ACEs in a SACL to generate audit messages for successful
							'access attempts. 
    CONST FAILED_ACCESS_ACE_FLAG 		= 128 	'Used with system-audit ACEs in a SACL to generate audit messages for failed
							'access attempts. 
    '********************* ACE Types *********************
    CONST ACCESS_ALLOWED_ACE_TYPE 		= 0 	'Used with Win32_Ace AceTypes
    CONST ACCESS_DENIED_ACE_TYPE 		= 1 	'Used with Win32_Ace AceTypes
    CONST AUDIT_ACE_TYPE 			= 2 	'Used with Win32_Ace AceTypes

    '********************* Access Masks *********************
    Dim Perms_LStr, Perms_SStr, Perms_Const
    'Permission LongNames
    Perms_LStr=Array("Synchronize"		, _
		"Take Ownership"		, _
		"Change Permissions"		, _
		"Read Permissions"		, _
		"Delete"			, _
		"Write Attributes"		, _
		"Read Attributes"		, _
		"Delete Subfolders and Files"	, _
		"Traverse Folder / Execute File", _
		"Write Extended Attributes"	, _
		"Read Extended Attributes"	, _
		"Create Folders / Append Data"	, _
		"Create Files / Write Data"	, _
		"List Folder / Read Data"	)
    'Permission Single Character codes
    Perms_SStr=Array(""	, _
		"D"	, _
		"C"	, _
		"B"	, _
		"A"	, _
		"9"	, _
		"8"	, _
		"7"	, _
		"6"	, _
		"5"	, _
		"4"	, _
		"3"	, _
		"2"	, _
		"1"	)
    'Permission Integer
    Perms_Const=Array(1048576	, _
		&H80000		, _
		&H40000		, _
		&H20000		, _
		&H10000		, _
		&H100		, _
		&H80		, _
		&H40		, _
		&H20		, _
		&H10		, _
		&H8		, _
		&H4		, _
		&H2		, _
		&H1		)

    'Initializing Default values
    a_Used = FALSE
    t_Used = FALSE
    e_Used = FALSE
    g_Used = FALSE
    r_used = FALSE
    p_Used = FALSE
    d_used = FALSE
    i_used = FALSE
    l_Used = FALSE
    q_Used = FALSE
    RemoteServer_Used = FALSE
    strRemoteServerName = ""
    strRemoteShareName = ""
    RemoteUserName_Used = FALSE
    strRemoteUserName = ""
    strRemotePassword = ""
    debug_Used = FALSE	'Parameter Passed
    filename_var = ""
    DisplayDirPath = ""
    ActualDirPath = ""
    debug_on = FALSE	'Actual value checked in script
    blnQuiet = FALSE
    strOutputFile = "XCACLS.Log"
    'Parse the command line
    intOpMode = intParseCmdLine()
    If Err.Number Then
	Wscript.Echo "Error while parsing the command line."
        Wscript.Echo "Error " & Err.Number & ": " & Err.Description
	WScript.Quit
    End if
    'Open the output file so we can use it through out the script
    If l_Used then Call OpenOutputFile()
    Call PrintMsg("Starting Script at " & now)
    'FSO is used in several funcitons, so lets set it globally.
    Set fso = WScript.CreateObject("Scripting.FileSystemObject")
    If blnErrorOccurred(" occurred in getting FileSystemObject.") Then WScript.Quit
    'Put statements in loop to be able to drop out and clear variables
    Do
	If debug_on then Call PrintMsg("Main: Enter")
	Call PrintArguments()	'Show the arguments entered
	'Now lets do the work based upon the arguments entered.
	Select Case intOpMode
	Case CONST_SHOW_USAGE
       		Call ShowUsage()
	Case CONST_PROCEED
		strRemoteServerName = ""
		'Lets get the objService object which is used throughout the script
		If Not SetMainVars(filename_var) then Exit Do
		Call PrintMsg("")
		Call CheckTrustees()
		If QryBaseNameHasWildcards or QryExtensionHasWildcards then
			If debug_on then Call PrintMsg("Wildcard characters detected in """ & InitialfilenameAbsPath & """")
			Select Case DoesPathNameExist(GetParentFolderName(InitialfilenameAbsPath))
			Case 1 'Directory
				Call DoTheWorkOnEverythingUnderDirectory(GetParentFolderName(InitialfilenameAbsPath))
			Case Else
				Call PrintMsg("Error: Directory """ & GetParentFolderName(InitialfilenameAbsPath) & """ not found.")
			End select
		Else
			If debug_on then Call PrintMsg("No Wildcard characters detected for """ & filename_var & """")
			'If a folder is found with the same name, then we work it as a folder and include files under it.
			Select Case DoesPathNameExist(InitialfilenameAbsPath)
			Case 1 'Directory
				If a_used then 
					Call DoTheWorkOnEverythingUnderDirectory(InitialfilenameAbsPath)
				Else
					Call DoTheWorkOnThisItem(InitialfilenameAbsPath, TRUE)
				End if
			Case 2 'File
				Call DoTheWorkOnThisItem(InitialfilenameAbsPath, FALSE)
			Case Else
				Call PrintMsg("Error: File/Directory """ & InitialfilenameAbsPath & """ not found.")
			End select
		End if
	Case Else
		Call PrintMsg("")
		Call PrintMsg(intOpMode)
	End Select
	Call blnErrorOccurred(" occurred while in the main routine of the script.")
	If debug_on then Call PrintMsg("Main: Exit")
	Exit Do		'We really didn't want to loop
    Loop
    'ClearObjects that could be set and aren't needed now
    Set objService = Nothing
    Set objLocalService = Nothing
    Set objLocator = Nothing
    Call ClearObjectArray(ObjTrustee_g_var_User)
    Call ClearObjectArray(ObjTrustee_r_var_User)
    Call ClearObjectArray(ObjTrustee_p_var_User)
    Call ClearObjectArray(ObjTrustee_d_var_User)
    Call PrintMsg("")
    Call PrintMsg("Ending Script at " & now)
    Call PrintMsg("")
    Call PrintMsg("")
    If l_Used then
	If strOutputFile <> "" Then
		objOutputFile.Close
	End if
    End if
'********************************************************************
'* End of Main Script
'********************************************************************

'********************************************************************
'*
'* Sub DoTheWorkOnEverythingUnderDirectory()
'* Purpose: Work on Directory path passed to it, and pass paths to DoTheWorkOnThisItem sub
'* Input:   ThisPath - Path to directory
'* Output:  None
'* Notes:   This sub will process every file and folder under the directory passed to it.
'*
'********************************************************************
Sub DoTheWorkOnEverythingUnderDirectory(ThisPath)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("DoTheWorkOnEverythingUnderDirectory: Enter")
    Dim objFileSystemSet, objPath, objFileSystemSet2, objPath2, strQuery, strTempPath, booltempItsAFolder
    Do
	If debug_on then Call PrintMsg("DoTheWorkOnEverythingUnderDirectory: Directory passed: """ & ThisPath & """")
	'We already checked for existance so we will assume it exists.

	strQuery = "Select * from Cim_LogicalFile Where Name='" & Replace(ThisPath,"\","\\") & "'"
        Set objFileSystemSet = objService.ExecQuery(strQuery,,0)
	If blnErrorOccurred(" occurred setting objFileSystemSet = objService.ExecQuery(" & strQuery & ",,0).") Then Exit Do
	strTempPath = ""
    	for each objPath in objFileSystemSet
		If objPath.Drive <> "" then
			strTempPath = objPath.Path & objPath.FileName & "\"
			strTempPath = Replace(strTempPath, "\\", "\")
			Exit For
		End if
    	next
	strQuery = "Select * from Cim_LogicalFile Where Path='" & Replace(strTempPath,"\","\\") & "'"
        Set objFileSystemSet2 = objService.ExecQuery(strQuery,,0)
	If blnErrorOccurred(" occurred setting objFileSystemSet2 = objService.ExecQuery(" & strQuery & ",,0).") Then Exit Do
    	for each objPath2 in objFileSystemSet2
		strTempPath = ""
		booltempItsAFolder = False
		If objPath2.Drive <> "" then
			If UCASE(objPath2.FileType) = "FILE FOLDER" then booltempItsAFolder = True
			strTempPath = objPath2.Name
			If QryBaseNameHasWildcards Or QryExtensionHasWildcards then
				If DoesItMatch(strTempPath) then
					Call DoTheWorkOnThisItem(strTempPath, booltempItsAFolder)
				End if
			Else
				'If there are no wildcards, then we are here because a /T was used or initial filename was a directory, so we do all files.
				Call DoTheWorkOnThisItem(strTempPath, booltempItsAFolder)
			End if
			If booltempItsAFolder then
				If t_Used then		'We should pass the same check to all sub folders 
					Call DoTheWorkOnEverythingUnderDirectory(strTempPath)
				End if
			End if
		End if
    	next
	Exit Do		'We really didn't want to loop
    Loop
    'ClearObjects that could be set and aren't needed now
    Set objPath = Nothing
    Set objFileSystemSet = Nothing
    Set objPath2 = Nothing
    Set objFileSystemSet2 = Nothing
    Call blnErrorOccurred(" occurred while in the DoTheWorkOnEverythingUnderDirectory routine.")
    If debug_on then Call PrintMsg("DoTheWorkOnEverythingUnderDirectory: Exit")
End Sub
'********************************************************************
'*
'* Sub DoTheWorkOnThisItem()
'* Purpose: Work on File/Folder passed to it, and pass to Work routine
'* Input:   ABSPath - Path to File/Folder
'* Output:  TRUE if Successful, FALSE if not
'*
'********************************************************************
Sub DoTheWorkOnThisItem(AbsPath, IsItAFolder)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("DoTheWorkOnThisItem: Enter")
    Dim DisplayIt
    Do
	DisplayIt = TRUE
	Call PrintMsg("")
	Call PrintMsg("**************************************************************************")
	If IsItAFolder then
		Call PrintMsg("Directory: " & DisplayPathString(AbsPath))
	Else
		Call PrintMsg("File: " & DisplayPathString(AbsPath))
	End if
	'We already checked for existance so we will assume it exists.
	If g_Used  or r_Used or p_Used or d_Used or o_used or i_used then 
		Call SetACLForObject(AbsPath, IsItAFolder)
		DisplayIt = FALSE
	End If
	If DisplayIt then 
		Call DisplayThisACL(AbsPath)
	End if
	Call PrintMsg("**************************************************************************")
	If t_used then Call DoTheWorkOnEverythingUnderDirectory(AbsPath)
	Exit Do
    Loop
    Call blnErrorOccurred(" occurred while in the DoTheWorkOnThisItem routine.")
    If debug_on then Call PrintMsg("DoTheWorkOnThisItem: Exit")
End Sub
'********************************************************************
'*
'* Sub DisplayThisACL()
'* Purpose: Shows ACL's that are applied to strPath
'* Input:   strPath - string containing path of file or folder, ShowLong - If TRUE, permissions are in long form
'* Output:  prints the acls
'*
'********************************************************************
Sub DisplayThisACL(strPath)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("DisplayThisACL: Enter")
    Dim objFileSecSetting, objOutParams, objSecDescriptor, objOwner, objDACL_Member
    Dim objtrustee, numAceFlags, strAceFlags, x, strAceType, numControlFlags
    ReDim arraystrACLS(0)
    'Put statements in loop to be able to drop out and clear variables
    Do
	set objFileSecSetting = objService.Get("Win32_LogicalFileSecuritySetting.Path='" & strPath & "'")
	If blnErrorOccurred(" occurred setting Win32_LogicalFileSecuritySetting object.") Then Exit Do
	Set objOutParams = objFileSecSetting.ExecMethod_("GetSecurityDescriptor")
	If blnErrorOccurred(" occurred when this command was issued: GetSecurityDescriptor.") Then Exit Do
	set objSecDescriptor = objOutParams.Descriptor
	If blnErrorOccurred(" occurred setting objSecDescriptor = objOutParams.Descriptor.") Then Exit Do
	numControlFlags = objSecDescriptor.ControlFlags
	If IsArray(objSecDescriptor.DACL) then
		Call PrintMsg("")
		Call PrintMsg("Permissions:")
		Call PrintMsg( strPackString("Type", 9, 1, TRUE) & strPackString("Username", 24, 1, TRUE) & strPackString("Permissions", 22, 1, TRUE) & strPackString("Inheritance", 22, 1, TRUE))
		For Each objDACL_Member in objSecDescriptor.DACL
			Select Case objDACL_Member.AceType
			Case ACCESS_ALLOWED_ACE_TYPE
				strAceType = "Allowed"
			Case ACCESS_DENIED_ACE_TYPE
				strAceType = "Denied"
			Case else
				strAceType = "Unknown"
			End select
			Set objtrustee = objDACL_Member.Trustee
			numAceFlags = objDACL_Member.AceFlags
			strAceFlags = StringAceFlag(numAceFlags, numControlFlags, SE_DACL_AUTO_INHERITED, FALSE)
			Call AddStringToArray(arraystrACLS, strPackString(strAceType, 9, 1, TRUE) & strPackString(objtrustee.Domain & "\" & objtrustee.Name, 24, 1, TRUE) & strPackString(SECString(objDACL_Member.AccessMask,TRUE), 22, 1, TRUE) & strPackString(strAceFlags, 22, 1, TRUE),-1)
			Set objtrustee = Nothing
		Next
		For x = LBound(arraystrACLS) to UBound(arraystrACLS)
			Call PrintMsg(arraystrACLS(x))
		Next 
	Else
		Call PrintMsg("")
		Call PrintMsg("No Permissions set")
	End if
	ReDim arraystrACLS(0)
	If IsArray(objSecDescriptor.SACL) then
		Call PrintMsg("")
		Call PrintMsg("Auditing:")
		Call PrintMsg(strPackString("Type", 9, 1, TRUE) & strPackString("Username", 24, 1, TRUE) & strPackString("Access", 22, 1, TRUE) & strPackString("Inheritance", 22, 1, TRUE))
		For Each objDACL_Member in objSecDescriptor.SACL
			Set objtrustee = objDACL_Member.Trustee
			numAceFlags = objDACL_Member.AceFlags
			strAceType = StringSACLAceFlag(numAceFlags)
			strAceFlags = StringAceFlag(numAceFlags, numControlFlags, SE_SACL_AUTO_INHERITED, FALSE)
			Call AddStringToArray(arraystrACLS, strPackString(strAceType, 9, 1, TRUE) & strPackString(objtrustee.Domain & "\" & objtrustee.Name, 24, 1, TRUE) & strPackString(SECString(objDACL_Member.AccessMask,TRUE), 22, 1, TRUE) & strPackString(strAceFlags, 22, 1, TRUE),-1)
			Set objtrustee = Nothing
		Next
		For x = LBound(arraystrACLS) to UBound(arraystrACLS)
			Call PrintMsg(arraystrACLS(x))
		Next 
	Else
		Call PrintMsg("")
		Call PrintMsg("No Auditing set")
	End if
	Set objOwner = objSecDescriptor.Owner
	If blnErrorOccurred(" occurred setting objOwner = objSecDescriptor.Owner.") Then Exit Do
	Call PrintMsg("")
	Call PrintMsg("Owner: " & objOwner.Domain & "\" & objOwner.Name)
	Exit Do		'We really didn't want to loop
    Loop
    'ClearObjects that could be set and aren't needed now
    Set objOwner = Nothing
    Set objSecDescriptor = Nothing
    Set objDACL_Member = Nothing
    Set objtrustee = Nothing
    Set objOutParams = Nothing
    Set objFileSecSetting = Nothing
    Call blnErrorOccurred(" occurred while in the DisplayThisACL routine.")
    If debug_on then Call PrintMsg("DisplayThisACL: Exit")
End Sub
'********************************************************************
'*
'* Sub SetACLForObject()
'* Purpose: Set the ACL for the file/folder passed
'* Input:   strPath - string containing path of file or folder, IsItAFolder, 
'* Output:  None
'*
'********************************************************************
Sub SetACLForObject(strPath, IsItAFolder)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("SetACLForObject: Enter")
    Dim objFileSecSetting, objmethod, objSecDescriptor
    Dim objtrustee, objInParam, objOutParams, objOwner
    Dim objParentFileSecSetting, objParentOutParams, objParentSecDescriptor
    Dim OldAceObj, ObjNewAce, NewobjDescriptor, RetVal, i_Var_Copy_Temp
    Dim BlankDaclObj, OldDaclObj(), NewDaclObj(), ImpDenyDaclObj()
    Dim ImpAllowDaclObj(), ImpDenyObjectDaclObj()
    Dim objTempTrustee, i, t, ThisUserAccess, RightsToGive, NewRights
    Dim intTempAccessMask, boolDoTheUpdate
    Dim strOldAccount, strThisAccount, NewArraySize, NewArrayMember, BoolDoThisOne
    Dim ControlFlagsVar, BoolAllowInherited, BoolGetInherited, BoolInitialInheritRightsPresent, numControlFlags
    'Put statements in loop to be able to drop out and clear variables
    Do
	'Initialize all of the new ACL objects
    	ReDim OldDaclObj(0)
    	ReDim NewDaclObj(0)
    	ReDim ImpDenyDaclObj(0)
    	ReDim ImpAllowDaclObj(0)
	ReDim InheritedObjectDaclObj(0)
	ReDim BlankDaclObj(0)
	BoolAllowInherited = FALSE
	BoolGetInherited = FALSE
	BoolInitialInheritRightsPresent = FALSE
	If debug_on then Call PrintMsg("SetACLForObject: Working on """ & strPath & """")
	set objFileSecSetting = objService.Get("Win32_LogicalFileSecuritySetting.Path='" & strPath & "'")
	If blnErrorOccurred(" occurred setting Win32_LogicalFileSecuritySetting object.") Then Exit Do
	Set objOutParams = objFileSecSetting.ExecMethod_("GetSecurityDescriptor")
	If blnErrorOccurred(" occurred Setting objOutParams = objFileSecSetting.ExecMethod_(""GetSecurityDescriptor"")") Then Exit Do
	set objSecDescriptor = objOutParams.Descriptor
	If blnErrorOccurred(" occurred setting objSecDescriptor = objOutParams.Descriptor.") Then Exit Do
	Set objOwner = objSecDescriptor.Owner
	If blnErrorOccurred(" occurred setting objOwner = objSecDescriptor.Owner.") Then Exit Do
	numControlFlags = objSecDescriptor.ControlFlags
	If debug_on then Call PrintMsg("SetACLForObject: Getting DACL array")
	Call GetDaclArray(OldDaclObj,objSecDescriptor, FALSE)
	If blnErrorOccurred(" occurred after Calling GetDaclArray(OldDaclObj,objSecDescriptor, FALSE)") Then Exit Do
	If UBound(OldDaclObj) = 0 then
		'If the array is empty and we need to Copy or Enable Inheritance, we need to set Inheritance and get array again.
		If i_used then
			If i_var < 3 then BoolGetInherited = TRUE
		End if
	Else
		'If Copy or Enable Inheritance is set and there was no Inherited Properties, we need to set Inheritance and get array again.
		If i_used then
			If i_var < 3 then BoolGetInherited = TRUE
			For i = 1 to UBound(OldDaclObj)
				If blnErrorOccurred(" occurred looping through OldDaclObj.") Then Exit Do
				Set OldAceObj = OldDaclObj(i)
				If StringAceFlag(OldAceObj.AceFlags, numControlFlags, SE_DACL_AUTO_INHERITED, TRUE) = "Inherited" then
					BoolInitialInheritRightsPresent = TRUE
					BoolGetInherited = FALSE
					Exit For 
				End if
			Next
		End if
	End if
	If BoolGetInherited Then	'We need the inherited ACE's so lets get them.
		If debug_on then Call PrintMsg("SetACLForObject: Inherited ACL's not found and needed, getting from Parent Directory")
		'Any existing ACE's will remain in array
		Set NewobjDescriptor = objService.Get("Win32_SecurityDescriptor").Spawninstance_
		If blnErrorOccurred(" occurred Setting NewobjDescriptor = objService.Get(""Win32_SecurityDescriptor"").Spawninstance_") Then Exit Do
		NewobjDescriptor.ControlFlags =  ALLOW_INHERIT
		If blnErrorOccurred(" occurred setting  objSecDescriptor.ControlFlags =  ALLOW_INHERIT") Then Exit Do
		Set objmethod = objFileSecSetting.Methods_("SetSecurityDescriptor")
		If blnErrorOccurred(" occurred setting objmethod = objFileSecSetting.Methods_(""SetSecurityDescriptor"")") Then Exit Do
		Set objInParam = objmethod.inParameters.SpawnInstance_()
		If blnErrorOccurred(" occurred Setting objInParam = objmethod.inParameters.SpawnInstance_()") Then Exit Do
		objInParam.Properties_.item("Descriptor") = NewobjDescriptor
		If blnErrorOccurred(" occurred setting objInParam.Properties_.item(""Descriptor"") = NewobjDescriptor") Then Exit Do
		Set RetVal = objFileSecSetting.ExecMethod_("SetSecurityDescriptor", objInParam)	
		If blnErrorOccurred(" occurred setting RetVal = objFileSecSetting.ExecMethod_(""SetSecurityDescriptor"", objInParam)") Then Exit Do
		'Now we need to get only the Inherited ACE's (Everyone group may be set if DACL array was empty)
		Set objOutParams = objFileSecSetting.ExecMethod_("GetSecurityDescriptor")
		If blnErrorOccurred(" occurred Setting objOutParams = objFileSecSetting.ExecMethod_(""GetSecurityDescriptor"")") Then Exit Do
		set objSecDescriptor = objOutParams.Descriptor
		If blnErrorOccurred(" occurred setting objSecDescriptor = objOutParams.Descriptor.") Then Exit Do
		Call GetDaclArray(OldDaclObj,objSecDescriptor, TRUE)
		If blnErrorOccurred(" occurred when Calling GetDaclArray(OldDaclObj,objSecDescriptor, TRUE)") Then Exit Do
		
		Set NewobjDescriptor = Nothing
		Set objmethod = Nothing
		Set objInParam = Nothing
		Set RetVal = Nothing
		boolDoTheUpdate = TRUE
	End if
	'Now we have the inherited rights, if one of the revoked users is in the list, then we need to copy the list and turn off inheritance.
	If debug_on then Call PrintMsg("SetACLForObject: Looking for Revoke users in Inherited list, if found, Inherited list will be copied to Effective list and inheritance turned off, so we can revoke user")
	i_Var_Copy_Temp = FALSE
	If r_Used then 	'Revoke user if present in Inherited Allowed or Denied lists
		If UBound(OldDaclObj) > 0 then
			For i = 1 to UBound(OldDaclObj)
				If blnErrorOccurred(" occurred looping through OldDaclObj.") Then Exit Do
				Set OldAceObj = OldDaclObj(i)
				If StringAceFlag(OldAceObj.AceFlags, numControlFlags, SE_DACL_AUTO_INHERITED, TRUE) = "Inherited" then		
					For t = LBound(r_var_User) to UBound(r_var_User)
						If r_Var_User(t) <> "" then
							If TrusteesMatch(ObjTrustee_r_var_User(t), OldAceObj.Trustee) then
								'We found a match
								i_Var_Copy_Temp = TRUE
								Call PrintMsg("  - One of the Revoked Users is listed under Inherited permissions.")
								Call PrintMsg("    Copying Inherited Permissions and turning off inheritance.")
								Exit For
							End if
						End if
					Next
				End if
			Next
		End If
	End If
	If debug_on then Call PrintMsg("SetACLForObject: Sorting DACL array and modifying rights if needed")
	If UBound(OldDaclObj) > 0 then
		For i = 1 to UBound(OldDaclObj)
			BoolDoThisOne = TRUE
			If blnErrorOccurred(" occurred looping through OldDaclObj.") Then Exit Do
			Set OldAceObj = OldDaclObj(i)
			Set objTempTrustee = OldAceObj.Trustee
			intTempAccessMask = OldAceObj.AccessMask
			If debug_on then Call PrintMsg("SetACLForObject: """ & TrusteesDisplay(objTempTrustee) & """ current rights = " & SECString(OldAceObj.AccessMask,TRUE))
			If StringAceFlag(OldAceObj.AceFlags, numControlFlags, SE_DACL_AUTO_INHERITED, TRUE) = "Inherited" then
				If i_Var_Copy_Temp then 'This makes sure that inherited users that are revoked can be revoked...
					OldAceObj.AceFlags = OBJECT_INHERIT_ACE + CONTAINER_INHERIT_ACE 
				Else
					BoolDoThisOne = FALSE
					If i_used then 	'We should make them effective ACL's
						Select Case i_var
						Case 1     'Inherit
							Call AddObjectToArray(InheritedObjectDaclObj, OldAceObj, -1)
						Case 2     'Copy to Effective
							OldAceObj.AceFlags = OBJECT_INHERIT_ACE + CONTAINER_INHERIT_ACE 
							BoolDoThisOne = TRUE
						End Select
					Else
						Call AddObjectToArray(InheritedObjectDaclObj, OldAceObj, -1)
					End If
				End if
			End if
			If p_Used then 	'Replace user rights if present
				For t = LBound(p_var_User) to UBound(p_var_User)
					If p_Var_User(t) <> "" then
						If TrusteesMatch(ObjTrustee_p_var_User(t), objTempTrustee) then
							'We found a match so skip it.
							BoolDoThisOne = FALSE
							Call PrintMsg("Replacing rights for existing user """ & p_Var_User(t) & """")
						End if
					End if
				Next
			Else
			End If
			If r_Used then 	'Revoke user if present in Allowed or Denied lists
				For t = LBound(r_var_User) to UBound(r_var_User)
					If r_Var_User(t) <> "" then
						If TrusteesMatch(ObjTrustee_r_var_User(t), objTempTrustee) then
							'We found a match so skip it.
							BoolDoThisOne = FALSE
							Call PrintMsg("Revoking rights for existing user """ & r_Var_User(t) & """")
						End if
					End if
				Next
			End if
			If BoolDoThisOne then
				Select Case OldAceObj.AceType
       				Case ACCESS_ALLOWED_ACE_TYPE
					Call AddObjectToArray(ImpAllowDaclObj, OldAceObj, -1)
				Case ACCESS_DENIED_ACE_TYPE
					Call AddObjectToArray(ImpDenyDaclObj, OldAceObj, -1)
				Case Else
					Call PrintMsg("Error: Bad ace...." & Hex(OldAceObj.AceType))
				End Select
			End if
		Next
	End If
	'Add ACE's that need to be added:
	If g_Used then 	'Grant rights for these users
		If debug_on then Call PrintMsg("SetACLForObject: Granting Rights for Users (that haven't been granted already)")
		Call AccessMask_New(ImpAllowDaclObj, ObjTrustee_g_var_User, g_var_User, g_var_Perm, ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE + OBJECT_INHERIT_ACE, "Granting")
		If blnErrorOccurred(" occurred when Building Granted (File) Rights array") Then Exit Do
		If IsItAFolder then
			Call AccessMask_New(ImpAllowDaclObj, ObjTrustee_g_var_User, g_var_User, g_var_Spec, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, "Granting")
			If blnErrorOccurred(" occurred when Building Granted (Folder) Rights array") Then Exit Do
		End if
	End if
	If p_Used then 	'Grant rights for these users (Replace rights)
		If debug_on then Call PrintMsg("SetACLForObject: Replacing Rights for Users (that haven't been granted already)")
		Call AccessMask_New(ImpAllowDaclObj, ObjTrustee_p_var_User, p_var_User, p_var_Perm, ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE + OBJECT_INHERIT_ACE , "Replacing")
		If blnErrorOccurred(" occurred when Building Replace (File) Rights array") Then Exit Do
		If IsItAFolder then
			Call AccessMask_New(ImpAllowDaclObj, ObjTrustee_p_var_User, p_var_User, p_var_Spec, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, "Replacing")
			If blnErrorOccurred(" occurred when Building Replace (Folder) Rights array") Then Exit Do
		End if
	End if
	If d_Used then 	'Deny rights for these users
		If debug_on then Call PrintMsg("SetACLForObject: Denying Rights for Users (that haven't been denied already)")
		Call AccessMask_New(ImpDenyDaclObj, ObjTrustee_d_var_User, d_var_User, d_var_Perm, ACCESS_DENIED_ACE_TYPE, INHERIT_ONLY_ACE + OBJECT_INHERIT_ACE , "Denying")
		If blnErrorOccurred(" occurred when Building Denied (File) Rights array") Then Exit Do
		If IsItAFolder then
			Call AccessMask_New(ImpDenyDaclObj, ObjTrustee_d_var_User, d_var_User, d_var_Spec, ACCESS_DENIED_ACE_TYPE, CONTAINER_INHERIT_ACE, "Denying")
			If blnErrorOccurred(" occurred when Building Denied (Folder) Rights array") Then Exit Do
		End if
	End if
	' Combine the ACEs in the proper order
	' Implicit Deny
	' Implicit Allow
	' Inherited Aces
	If debug_on then Call PrintMsg("SetACLForObject: Forming new DACL array")
	boolDoTheUpdate = FALSE
	ReDim NewDaclObj(0)
	If UBound(ImpDenyDaclObj) > 0 then		'0 member is always blank
		For i = (LBound(ImpDenyDaclObj) + 1) to UBound(ImpDenyDaclObj)
			boolDoTheUpdate = TRUE
			Call AddObjectToArray(NewDaclObj, ImpDenyDaclObj(i), 0)
		Next
		If blnErrorOccurred(" occurred when Building Implicit Deny array") Then Exit Do
	End if
	If UBound(ImpAllowDaclObj) > 0 then
		For i = (LBound(ImpAllowDaclObj) + 1) to UBound(ImpAllowDaclObj)
			boolDoTheUpdate = TRUE
			Call AddObjectToArray(NewDaclObj, ImpAllowDaclObj(i), 0)
		Next
		If blnErrorOccurred(" occurred when Building Implicit Allow array") Then Exit Do
	End if
	If UBound(InheritedObjectDaclObj) > 0 then
		BoolAllowInherited = TRUE
		For i = (LBound(InheritedObjectDaclObj) + 1) to UBound(InheritedObjectDaclObj)
			boolDoTheUpdate = TRUE
			InheritedObjectDaclObj(i).AccessMask = 0
			Call AddObjectToArray(NewDaclObj, InheritedObjectDaclObj(i), 0)
		Next
		If blnErrorOccurred(" occurred when Building Inherited Object array") Then Exit Do
	End if
	If Not boolDoTheUpdate Then
		Set NewDaclObj(0) = CreateObject("AccessControlEntry")
		If blnErrorOccurred(" occurred Setting NewDaclObj(0) = CreateObject(""AccessControlEntry"").") Then Exit Do
	End if
	If i_Var_Copy_Temp then
		If debug_on then Call PrintMsg("SetACLForObject: Inheritance turned off because one of the inherited users is revoked on this object.")
		ControlFlagsVar = SE_DACL_PRESENT
	Else
		If i_used then
			Select Case i_var
			Case 1
				ControlFlagsVar = ALLOW_INHERIT
			Case 3
				ControlFlagsVar = DENY_INHERIT
			case Else '2 and non matching
				ControlFlagsVar = SE_DACL_PRESENT
			End Select
		Else
			If BoolAllowInherited or BoolInitialInheritRightsPresent then
				ControlFlagsVar = ALLOW_INHERIT
			Else
				ControlFlagsVar = DENY_INHERIT
			End if
		End if
	End if
	If debug_on then Call PrintMsg("SetACLForObject: Saving new Descriptor")
	Set NewobjDescriptor = objService.Get("Win32_SecurityDescriptor").Spawninstance_
	If blnErrorOccurred(" occurred Setting NewobjDescriptor = objService.Get(""Win32_SecurityDescriptor"").Spawninstance_") Then Exit Do
	If boolDoTheUpdate then
		NewobjDescriptor.Properties_.item("DACL") = NewDaclObj
		If blnErrorOccurred(" occurred setting NewobjDescriptor.Properties_.item(""DACL"") = NewDaclObj") Then Exit Do
	Else	'Making DACL Blank
		Set BlankDaclObj(0) = objService.Get("Win32_Ace").Spawninstance_
		If blnErrorOccurred(" occurred Setting BlankDaclObj(0) = objService.Get(""Win32_Ace"").Spawninstance_") Then Exit Do
		NewobjDescriptor.Properties_.item("DACL") = BlankDaclObj
		If blnErrorOccurred(" occurred setting NewobjDescriptor.Properties_.item(""DACL"") = BlankDaclObj") Then Exit Do
	End if
	If o_Used then 	'Change Ownership
		If debug_on then Call PrintMsg("SetACLForObject: Changing Ownership")
		If o_Var <> "" then
			Set objTempTrustee = Nothing
			Set objTempTrustee = SetTrustee(o_var)
			If Not objTempTrustee Is Nothing then
				If TrusteesMatch(objOwner, objTempTrustee) then
					Call PrintMsg("Ownership not changed, owner is already set to """ & TrusteesDisplay(objTempTrustee) & """")
				Else
					NewobjDescriptor.Properties_.item("Owner") = objTempTrustee
					If blnErrorOccurred(" occurred setting NewobjDescriptor.Properties_.item(""Owner"") = objTempTrustee") Then Exit Do				
					Call PrintMsg("Changed Ownership to """ & TrusteesDisplay(objTempTrustee) & """")
				End if
			Else
				Call PrintMsg("Failed to Change Ownership to user """ & o_var & """")
			End if
		End if
	End if
	NewobjDescriptor.ControlFlags =  ControlFlagsVar
	If blnErrorOccurred(" occurred setting  NewobjDescriptor.ControlFlags =  ControlFlagsVar") Then Exit Do
	Set objmethod = objFileSecSetting.Methods_("SetSecurityDescriptor")
	If blnErrorOccurred(" occurred setting objmethod = objFileSecSetting.Methods_(""SetSecurityDescriptor"")") Then Exit Do
	Set objInParam = objmethod.inParameters.SpawnInstance_()
	If blnErrorOccurred(" occurred Setting objInParam = objmethod.inParameters.SpawnInstance_()") Then Exit Do
	objInParam.Properties_.item("Descriptor") = NewobjDescriptor
	If blnErrorOccurred(" occurred setting objInParam.Properties_.item(""Descriptor"") = NewobjDescriptor") Then Exit Do
	Set RetVal = objFileSecSetting.ExecMethod_("SetSecurityDescriptor", objInParam)	
	If blnErrorOccurred(" occurred setting RetVal = objFileSecSetting.ExecMethod_(""SetSecurityDescriptor"", objInParam)") Then Exit Do
	Call PrintMsg("Completed successfully.")
	Exit Do											'We really didn't want to loop
    Loop
    'ClearObjects that could be set and aren't needed now
    Set objOwner = Nothing
    Set objFileSecSetting = Nothing
    Set objmethod = Nothing
    Set objSecDescriptor = Nothing
    Set objtrustee = Nothing
    Set objInParam = Nothing
    Set objOutParams = Nothing
    Set OldAceObj = Nothing
    Set ObjNewAce = Nothing
    Set NewobjDescriptor = Nothing
    Set objTempTrustee = Nothing
    Set RetVal = Nothing
    Call blnErrorOccurred(" occurred while in the SetACLForObject routine.")				
    If debug_on then Call PrintMsg("SetACLForObject: Exit")
End Sub

'********************************************************************
'*
'* Function AccessMask_New()
'* Purpose: Takes a list of users with permissions and adds them to the list
'* Input:   Array_ACLobj	:	DACL Array
'*          Array_Users		:	Array of users
'*          Array_Perm		:	Array of permissions
'*          AceType		:	Type of Permissions (Allow or Deny)
'*          AceFlag		:	Apply to what (Files or Folders)
'*          strAction		:	String saying what the action was (Grant, Replace, or Deny)
'* Output:  Acl Array Object
'*
'********************************************************************
Function AccessMask_New(byref Array_ACLobj, byref Array_ObjTrustee, Array_Users, Array_Perm, AceType, AceFlag, strAction)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("AccessMask_New: Enter")
    Dim t, objNEWACE, RightsToGive, AceTypeString
    'Put statements in loop to be able to drop out and clear variables
    Do
	AccessMask_New = FALSE
	If AceFlag = CONTAINER_INHERIT_ACE then
		AceTypeString = """This Folder and Subfolders"""
	Else
		AceTypeString = """Files Only"""
	End if
	For t = LBound(Array_Users) to UBound(Array_Users)
		If blnErrorOccurred(" occurred while " & strAction & " permissions.") Then Exit Do
		If Array_Users(t) <> "" and Array_Perm(t) <> "" then
			If IsObject(Array_ObjTrustee(t)) then
				RightsToGive = SECBitMask(Array_Perm(t))
				If blnErrorOccurred(" occurred getting rights for " & Array_Users(t) & ".") Then Exit Do
				Set objNEWACE = SetACE(RightsToGive, AceFlag, AceType, Array_ObjTrustee(t))
				If blnErrorOccurred(" occurred creating ""ACE Object"" for " & Array_Users(t) & ".") Then Exit Do
				Call AddObjectToArray(Array_ACLobj, objNEWACE, -1)
				If blnErrorOccurred(" occurred adding (" & strAction & ") New ACE object to array.") Then Exit Do
				Set objNEWACE = Nothing
				Call PrintMsg(strAction & " NTFS rights (" & SECString(RightsToGive,TRUE) & " access for " & AceTypeString & ") for """ & Array_Users(t) & """")
			Else
				Call PrintMsg("Failed " & strAction & " NTFS rights (" & AceTypeString & ") for """ & Array_Users(t) & """")
			End if
		End if
	Next
	AccessMask_New = TRUE
	Exit Do		'We really didn't want to loop
    Loop
    Set objNEWACE = Nothing
    If debug_on then Call PrintMsg("AccessMask_New: Return = " & AccessMask_New)
    Call blnErrorOccurred(" occurred while in the AccessMask_New routine.")
    If debug_on then Call PrintMsg("AccessMask_New: Exit")
End Function

'********************************************************************
'*
'* Sub TrusteesMatch()
'* Purpose: Checks the Trustee to the Name and Domain and returns boolean TRUE if they match
'* Input:   objTrusteeA, objTrusteeB
'* Output:  Boolean
'* Notes:   This is a nice way to check if one trustee matches another, the procedure can change
'*          and compare different values and only needs to be changed here, not in the rest of the code.
'*
'********************************************************************
Function TrusteesMatch(ByRef objTrusteeA, ByRef objTrusteeB)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("TrusteesMatch: Enter")
    'Put statements in loop to be able to drop out and clear variables
    Do
	TrusteesMatch = FALSE
	If debug_on then Call PrintMsg("TrusteesMatch: Checking Users to see if they match")	
	If NOT IsObject(objTrusteeA) then 
		Exit Do
	End if
	If NOT IsObject(objTrusteeB) then 
		Exit Do
	End if
	If objTrusteeA.SIDString = objTrusteeB.SIDString then
		TrusteesMatch = TRUE
	End if
	Exit Do		'We really didn't want to loop
    Loop
    Call blnErrorOccurred(" occurred while in the TrusteesMatch routine.")
    If debug_on then Call PrintMsg("TrusteesMatch: Exit")
End Function
'********************************************************************
'*
'* Sub TrusteesDisplay()
'* Purpose: Returns a Display ready string of trustee passed in
'* Input:   objTrustee
'* Output:  String
'* Notes:   This makes the display of a trustee a standard throughout the code
'*
'********************************************************************
Function TrusteesDisplay(ByRef objTrustee)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("TrusteesDisplay: Enter")
    'Put statements in loop to be able to drop out and clear variables
    Do
	TrusteesDisplay = ""
	If NOT IsObject(objTrustee) then 
		Exit Do
	End if
	If objTrustee.Domain = "" then
		TrusteesDisplay = objTrustee.Name
	Else
		TrusteesDisplay = objTrustee.Domain & "\" & objTrustee.Name
	End if
	Exit Do		'We really didn't want to loop
    Loop
    Call blnErrorOccurred(" occurred while in the TrusteesDisplay routine.")
    If debug_on then Call PrintMsg("TrusteesDisplay: Exit")
End Function
'********************************************************************
'*
'* Sub CheckTrustees()
'* Purpose: Checks the list of entered users and makes them valid, run only once
'* Input:   Global Variables only
'* Output:  None
'* Notes:   This function is called only one time in the code to get a trustee object for
'*          every user entered, and if we can't find one then the user is deleted from the list.
'*
'********************************************************************
Sub CheckTrustees()
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("CheckTrustees: Enter")
    'Put statements in loop to be able to drop out and clear variables
    Do
	If debug_on then Call PrintMsg("CheckTrustees: Checking Users to make sure they are proper Trustee's")
	Call GetDefaultNames()
	Call GetDefaultDomainSid()
	If g_Used then 	'Add to users
		If debug_on then Call PrintMsg("CheckTrustees: Checking /G users")
		If FixListOfTrustees(g_Var_User, ObjTrustee_g_var_User, "/G") = FALSE then exit Do
	End if
	If p_Used then 	'Replace users
		If debug_on then Call PrintMsg("CheckTrustees: Checking /P users")
		If FixListOfTrustees(p_Var_User, ObjTrustee_p_var_User, "/P") = FALSE then exit Do
	End if
	If d_Used then 	'Change users
		If debug_on then Call PrintMsg("CheckTrustees: Checking /D users")
		If FixListOfTrustees(d_Var_User, ObjTrustee_d_var_User, "/D") = FALSE then exit Do
	End if
	If r_Used then 	'Revoke users
		If debug_on then Call PrintMsg("CheckTrustees: Checking /R users")
		If FixListOfTrustees(r_Var_User, ObjTrustee_r_var_User, "/R") = FALSE then exit Do
	End if		
	Exit Do		'We really didn't want to loop
    Loop
    Call blnErrorOccurred(" occurred while in the CheckTrustees routine.")
    If debug_on then Call PrintMsg("CheckTrustees: Exit")
End Sub

'********************************************************************
'*
'* Function FixListOfTrustees()
'* Purpose: Takes a list of users and changes to a valid trustee if found, else sets string to ""
'* Input:   Array_Users, strAction
'* Output:  Dacl Array Object
'*
'********************************************************************
Function FixListOfTrustees(byref Array_Users, byref Array_ObjTrustee, strAction)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("FixListOfTrustees: Enter")
    Dim t, objTempTrustee, strTempName
    'Put statements in loop to be able to drop out and clear variables
    Do
	FixListOfTrustees = FALSE
	For t = LBound(Array_Users) to UBound(Array_Users)
		strTempName = ""
		If Array_Users(t) <> "" then
			'First, lets remove any special quotes in the string
			'Quotation mark (")                   34
			Array_Users(t) = Replace(Array_Users(t),chr(34),"")
			'Single turned comma quotation mark  145
			Array_Users(t) = Replace(Array_Users(t),chr(145),"")
			'Single comma quotation mark         146
			Array_Users(t) = Replace(Array_Users(t),chr(146),"")
			'Double turned comma quotation mark  147
			Array_Users(t) = Replace(Array_Users(t),chr(147),"")
			'Double comma quotation mark         148
			Array_Users(t) = Replace(Array_Users(t),chr(148),"")
			Set objTempTrustee = SetTrustee(Array_Users(t))
			If blnErrorOccurred(" occurred Setting objTempTrustee = SetTrustee(Array_Users(t))") Then Exit Do
			If objTempTrustee Is Nothing then
				Call PrintMsg("Could not find " & strAction & " user/group: """ & Array_Users(t) & """ removing from list.")
				Array_Users(t) = ""
			Else
				strTempName = TrusteesDisplay(objTempTrustee)
				Call AddObjectToArray(Array_ObjTrustee, objTempTrustee, t)
				If IsNull(objTempTrustee.Domain) then objTempTrustee.Domain = ""
				If UCase(Array_Users(t)) <> UCASE(strTempName) then
					Call PrintMsg(" - Changing " & strAction & " user/group: """ & Array_Users(t) & """ to """ & strTempName & """")
				End if
				Array_Users(t) = strTempName
				Set objTempTrustee = Nothing
			End if
		End if
	Next
	FixListOfTrustees = TRUE	'Means we didn't have an error and went through the entire list
	Exit Do		'We really didn't want to loop
    Loop
    Set objTempTrustee = Nothing
    If debug_on then Call PrintMsg("FixListOfTrustees: Return = " & FixListOfTrustees)
    Call blnErrorOccurred(" occurred while in the FixListOfTrustees routine.")
    If debug_on then Call PrintMsg("FixListOfTrustees: Exit")
End Function

'********************************************************************
'*
'* Sub GetDaclArray()
'* Purpose: Return Dacl Array object if found
'* Input:   objArrayPassedIn, objSecDescriptor, getonlyInherited
'* Output:  Dacl Array Object
'*
'********************************************************************
Sub GetDaclArray(DACL_Array, objSecDescriptor, getonlyInherited)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("GetDaclArray: Enter")
    Dim TempDACL_Array, objDACL_Member, numControlFlags
    'Put statements in loop to be able to drop out and clear variables
    Do
	numControlFlags = objSecDescriptor.ControlFlags
	If blnErrorOccurred(" occurred getting ControlFlags.") Then Exit Do

	TempDACL_Array = objSecDescriptor.DACL
	If blnErrorOccurred(" occurred getting Temporary DACL array.") Then Exit Do
	If IsArray(TempDACL_Array) then
		For Each objDACL_Member in TempDACL_Array
			If blnErrorOccurred(" occurred while looping through TempDACL_Array.") Then Exit Do
			If getonlyInherited then
				If StringAceFlag(objDACL_Member.AceFlags, numControlFlags, SE_DACL_AUTO_INHERITED, TRUE) = "Inherited" then Call AddObjectToArray(DACL_Array, objDACL_Member, -1)
			Else
				Call AddObjectToArray(DACL_Array, objDACL_Member, -1)
			End If
		Next
	End if
	If (UBound(DACL_Array) = 0) Then
		Set DACL_Array(0) = CreateObject("AccessControlEntry")
		If blnErrorOccurred(" occurred Setting DACL_Array(0) = CreateObject(""AccessControlEntry"").") Then Exit Do
	End if
	Exit Do		'We really didn't want to loop
    Loop
    'ClearObjects that could be set and aren't needed now
    Set objDACL_Member = Nothing
    Call blnErrorOccurred(" occurred while in the GetDaclArray routine.")
    If debug_on then Call PrintMsg("GetDaclArray: Exit")
End Sub

'********************************************************************
'* Function SetTrustee()
'* Purpose: Returns Win32_Trustee object for User/group or Nothing if not found
'* Input:   strFullName
'* Output:  Win32_Trustee object is returned, Nothing if not found
'********************************************************************
Function SetTrustee(strFullName)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("SetTrustee: Enter")
    Dim objTrustee, objAccount, objSID, strSid, strDomain, strName
    'Put statements in loop to be able to drop out and clear variables
    Do
	Set SetTrustee = Nothing
	strSid = ""
	Set objTrustee = objService.Get("Win32_Trustee").Spawninstance_
	'GetStandardSid will parse the strFullname into strDomain and strName
	strSid = GetStandardSid(strFullName, strDomain, strName)
	If strSid <> "" then
		objTrustee.Domain = strDomain
		objTrustee.Name = strName
		If blnErrorOccurred(" occurred setting Domain and Name for Trustee object.") Then 
			Exit Do
		End if
	Else
		Set objAccount = GetAccountObj(strDomain, strName)
		If blnErrorOccurred(" occurred getting Account Object.") Then 
			Exit Do
		End if
		If objAccount Is Nothing then 
			Call PrintMsg("Can't find Sid for: """ & strFullName & """")
			Exit Do
		Else
			strSid = objAccount.Sid
	    	End If
		objTrustee.Domain = objAccount.Domain
		objTrustee.Name = objAccount.Name
		If blnErrorOccurred(" occurred setting Domain and Name for Trustee object.") Then 
			Exit Do
		End if
	End If
	If strSid = "" then 'This means it doesn't exist
		Call PrintMsg("Can't find Sid for: """ & strFullName & """")
		Exit Do
   	End if
	set objSID = objService.Get("Win32_SID.SID='" & strSid &"'")
	If blnErrorOccurred(" occurred getting Win32_SID.SID Object.") Then 
		Exit Do
	End if

	objTrustee.Properties_.item("SID") = objSID.BinaryRepresentation
	objTrustee.Properties_.item("SidLength") = objSID.SidLength
	objTrustee.Properties_.item("SIDString") = objSID.Sid
	set objSID = nothing
	Set objAccount = Nothing
	set SetTrustee = objTrustee
	Exit Do		'We really didn't want to loop
    Loop
    'ClearObjects that could be set and aren't needed now
    Set objTrustee = Nothing
    Set objAccount = Nothing
    Set objSID = Nothing
    If debug_on then 
	If SetTrustee is Nothing then
		Call PrintMsg("SetTrustee: Return = " & "Nothing")
	Else
		Call PrintMsg("SetTrustee: Return = " & "Win32_Trustee object")
	End if
    End if
    Call blnErrorOccurred(" occurred while in the SetTrustee routine.")
    If debug_on then Call PrintMsg("SetTrustee: Exit")
End Function
'********************************************************************
'* Function GetStandardSid()
'* Purpose: Returns Sid if the account is a special account
'* Input:   strFullName
'* Output:  String Value of Sid
'********************************************************************
Function GetStandardSid(ByRef strFullName, ByRef strDomain, ByRef strName)
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("GetStandardSid: Enter")
    Dim strSpecialDomain
    'Put statements in loop to be able to drop out and clear variables
    Do
	strDomain = ""
	strName = ""
	If InStr(1, strFullName, "\",1) > 0 then
		strDomain = Left(strFullName, InStr(1, strFullName, "\",1) - 1)
		strName = Mid(strFullName, InStr(1, strFullName, "\",1) + 1)
	Else
		If InStr(1, strFullName, "/",1) > 0 then
			strDomain = Left(strFullName, InStr(1, strFullName, "/",1) - 1)
			strName = Mid(strFullName, InStr(1, strFullName, "/",1) + 1)
		Else
			strName = strFullName
		End if
	End if
	strSpecialDomain = ""
	'List comes primarily from http://support.microsoft.com/support/kb/articles/q243/3/30.asp 
	Select Case UCase(strName)
	Case "EVERYONE"
		GetStandardSid = "S-1-1-0"
	Case "CREATOR GROUP"
		GetStandardSid = "S-1-3-1"
	Case "CREATOR OWNER"
		GetStandardSid = "S-1-3-0"
	Case "DIALUP"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-1"
	Case "NETWORK"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-2"
	Case "BATCH"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-3"
	Case "INTERACTIVE"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-4"
	Case "SERVICE"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-6"
	Case "ANONYMOUS LOGON"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-7"
	Case "PROXY"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-8"
	Case "ENTERPRISE DOMAIN CONTROLLERS", "ENTERPRISE DOMAIN"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-9"
	Case "PRINCIPAL SELF", "SELF"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-10"
	Case "AUTHENTICATED USERS"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-11"
	Case "RESTRICTED"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-12"
	Case "TERMINAL SERVER USERS"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-13"
	Case "LOCAL SYSTEM", "SYSTEM"
		strSpecialDomain = "NT AUTHORITY"
		GetStandardSid = "S-1-5-18"
	Case "ADMINISTRATORS"
		strSpecialDomain = "BUILTIN"
		GetStandardSid = "S-1-5-32-544"
	Case "BACKUP OPERATORS"
		strSpecialDomain = "BUILTIN"
		GetStandardSid = "S-1-5-32-551"
	Case "GUESTS"
		strSpecialDomain = "BUILTIN"
		GetStandardSid = "S-1-5-32-546"
	Case "POWER USERS"
		strSpecialDomain = "BUILTIN"
		GetStandardSid = "S-1-5-32-547"
	Case "REPLICATOR"
		strSpecialDomain = "BUILTIN"
		GetStandardSid = "S-1-5-32-552"
	Case "USERS"
		strSpecialDomain = "BUILTIN"
		GetStandardSid = "S-1-5-32-545"
	Case "ADMINISTRATOR"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-500"
			strSpecialDomain = strSystemDomainName
		End if
	Case "GUEST"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-501"
			strSpecialDomain = strSystemDomainName
		End if
	Case "KRBTGT"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-502"
			strSpecialDomain = strSystemDomainName
		End if
	Case "DOMAIN ADMINS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-512"
			strSpecialDomain = strSystemDomainName
		End if
	Case "DOMAIN USERS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-513"
			strSpecialDomain = strSystemDomainName
		End if
	Case "GUESTS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-514"
			strSpecialDomain = strSystemDomainName
		End if
	Case "DOMAIN COMPUTERS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-515"
			strSpecialDomain = strSystemDomainName
		End if
	Case "DOMAIN CONTROLLERS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-516"
			strSpecialDomain = strSystemDomainName
		End if
	Case "CERT PUBLISHERS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-517"
			strSpecialDomain = strSystemDomainName
		End if
	Case "SCHEMA ADMINS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-518"
			strSpecialDomain = strSystemDomainName
		End if
	Case "GROUP POLICY CREATOR OWNERS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-520"
			strSpecialDomain = strSystemDomainName
		End if
	Case "RAS AND IAS SERVERS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-533"
			strSpecialDomain = strSystemDomainName
		End if
	Case "GUESTS"
		if strSystemDomainSid <> "" then 
			GetStandardSid = "S-1-5-" & strSystemDomainSid & "-514"
			strSpecialDomain = strSystemDomainName
		End if
	Case Else
		GetStandardSid = ""
	End Select
	'If a Domain was originally entered, then we make sure it matches or we remove SID string
	If strDomain = "" then
		If GetStandardSid <> "" then
			If strSpecialDomain <> "" then
				Call PrintMsg(" - Changing entered user/group: """ & strFullName & """ to """ & strSpecialDomain & "\" & strName & """")
				strFullName = strSpecialDomain & "\" & strName
				strDomain = strSpecialDomain
			End if
		Else
			Call PrintMsg(" - Changing entered user/group: """ & strFullName & """ to """ & strDefaultDomain & "\" & strName & """")
			strFullName = strDefaultDomain & "\" & strName
			strDomain = strDefaultDomain
		End if
	Else
		If UCase(strDomain) <> UCASE(strSpecialDomain) then
			GetStandardSid = ""
		End if
	End if
	Exit Do		'We really didn't want to loop
    Loop
    If debug_on then 
	If GetStandardSid <> "" then
		Call PrintMsg("GetStandardSid: Return = " & GetStandardSid)
	Else
		Call PrintMsg("GetStandardSid: Return = NOTHING")
	End if
    End if
    Call blnErrorOccurred(" occurred while in the GetStandardSid routine.")
    If debug_on then Call PrintMsg("GetStandardSid: Exit")
End Function
'********************************************************************
'*
'* Function SetACE()
'*
'* Purpose: Returns Win32_Ace object for objTrustee or Nothing if not found
'*
'* Input:   AccessMask, AceFlags, AceType, objTrustee
'*
'* Output:  Win32_Ace object is returned, Nothing if not found
'*
'********************************************************************
Function SetACE(AccessMask, AceFlags, AceType, objTrustee)
    ON ERROR RESUME NEXT
    Dim objACE
    If debug_on then Call PrintMsg("SetACE: Enter")
    Do		'For Error Control
	set objACE = objService.Get("Win32_Ace").Spawninstance_
	If blnErrorOccurred(" occurred while getting Win32_Ace.Spawninstance object") Then Exit Do
	objACE.Properties_.item("AccessMask") = AccessMask
	objACE.Properties_.item("AceFlags") = AceFlags
	objACE.Properties_.item("AceType") = AceType
	objACE.Properties_.item("Trustee") = objTrustee
	set SetACE = objACE
	Exit Do
    Loop
    'ClearObjects that could be set and aren't needed now
    Set objACE = Nothing
    If debug_on then 
	If SetACE is Nothing then
		Call PrintMsg("SetACE: Return = " & "Nothing")
	Else
		Call PrintMsg("SetACE: Return = " & "Win32_Ace object")
	End if
    End if
    Call blnErrorOccurred(" occurred while in the SetACE routine.")
    If debug_on then Call PrintMsg("SetACE: Exit")
End Function
'********************************************************************
'*
'* Sub GetDefaultNames()
'* Purpose: Return a Domain name and Computer Name
'* Input:   None
'* Output:  Sets Global Vars for Domain Name and Computer Name
'*
'********************************************************************
Sub GetDefaultNames()
    ON ERROR RESUME NEXT
    If debug_on then Call PrintMsg("GetDefaultNames: Enter")
    Dim objSystemSet, objSystem, intRole

    'Put statements in loop to be able to drop out and clear variables
    Do
        Set objSystemSet = objService.ExecQuery("Select * from Win32_ComputerSystem",,0)
	If blnErrorOccurred(" occurred setting objSystemSet = objService.ExecQuery(""Select * from Win32_ComputerSystem"",,0).") Then Exit Do
	strDefaultDomain = ""
	strSystemDomainName = ""
    	for each objSystem in objSystemSet
		If objSystem.Name <> "" then
			If objSystem.Domain <> "" then
				strSystemDomainName = objSystem.Domain
			Else
				strSystemDomainName = objSystem.Name
			End if 
			intRole = objSystem.DomainRole
			Select Case intRole
			Case 0 		'Standalone Workstation
				strDefaultDomain = objSystem.Name
			Case 1		'Member Workstation
				If CONST_USE_LOCAL_FOR_NON_DCs then
					strDefaultDomain = objSystem.Name
				Else
					strDefaultDomain = objSyst

Cool insights. I appreciate that. It just seems like a ton of code to do a simple task to set perms on one folder.

When a new employee comes on board, to do:
(1) Create a remote folder
(2) Set the share
(3) Set the perms

I think with the code that I have it works pretty well. That is, even though it only sets security and not the share perms.

Thanks!

- Kent

[ 11 August 2001: Message edited by: kdyer ]

I only posted so that others could see the lengths that WSH could go to.

The only reason MS came up with this is because the XCACLS for 2000 is broken and I guess since they are moving more and more to the .NET stuff, they maybe wanted to replace it with some type of Script instead of an .EXE

In fact, I need to really look at scripting (via KiXtart) how to create an account from scratch, create the folder, share the folder, and assign proper permissions, then assign the Home Folder in User Manager, all from reading a text file of names.

Need to create the account first and give the system time to know it exists before creating the folder and sharing it and then applying the new user's permissions.

If only there was less money and more time, Oh! that's what MANAGEMENT wants.... I mean if only there was MORE MONEY and Less Time I spent here

Per Shawn's suggestion, I took heed and converted the WSH to KIX. I ran it through KIXSTRIP for 4.00. It is untested as I don't have my 2000 box here, but is starting to look O.K. So, here goes....

code:

---

 ; -- createshare.kix
 ; -- 08/10/2001 
 ; -- Kent Dyer 
 ; -- Version .8a Release 
 ; The basis of this is using code from - http://cwashington.netreach.net/script_repository/view_scripts.asp?Index=360&S criptType=vbscript  
 ; It requires the ADSI SDK from - http://www.microsoft.com/NTWorkstation/downloads/Other/ADSI25.asp  
 ; You will need to REGSVR32 the ADSSECURITY.DLL from the ADSI SDK 
 BREAK ON
 CLS
 ; Check for Kix version 4.x and up
 $kixv = InStr(@KIX, "4.")
 If $kixv = 0
	? "Kix 4.00 is required - Sorry."
	Sleep 2
 Exit
 EndIf
 DIM $textusr
 DIM $textshare
 ; Create objects 
 $ofs = CreateObject("Scripting.FileSystemObject")
 $sec = CreateObject("ADsSecurity")
 IF $sec
       ; Capture the name of the person you are working with 
       COLOR g+/n
       ? "Enter the userid of the person - jdoe"
       COLOR w+/n
       ? 
       GETS $textusr
       IF $textusr = ""
             COLOR r+/n
             ? "No UserID input provided.  Stopping script now."
             COLOR w+/n
             SLEEP 2
             EXIT
       ENDIF
       ; Capture the name of the server are you adding the share to 
       COLOR g+/n
       ? "Enter the server - server"
       COLOR w+/n
         
       ? 
       GETS $textshare
       IF $textshare = ""
             COLOR r+/n
             ? "No Server Name input provided.  Stopping script now."
             COLOR w+/n
             SLEEP 2
             EXIT
       ENDIF
       ; Setting the user$ variable - jdoe$ - Hidden shares don;t show when browsing to a server 
       $textsharen = $textusr & Chr(36)
       ; Path for user folders 
       $usershare = "\\" & $textshare & "\users"
       ; Now let;s create a variable to work with - \\SERVER\users\jdoe 
       ; Directory to save 
       $userdir = "\\"& $textshare & "\users\" & $textusr
       ; Create folder 
       $createfolder = Exist($userdir)
       IF $createfolder <> 1
             MD $userdir
       ENDIF
       ; Create share 
       $fservobj = GetObject("WinNT://"& $textshare & "/lanmanserver")
       ; Create the share for the server jdoe$ 
       $newshare = $fservobj.create("fileshare",$textsharen)
       ; Set the path for the share on the server - D:\Users 
       $newshare.path = "D:\Users\" & $textusr
       $newshare.setinfo
       $newshare = Nothing
       ; Set ACLs 
       $filenm = $userdir
       $permspart = "add(" & $textusr & ":c)+add(domain admins:F)+add(Administrators:F)+del(everyone:F)"
       ;-- Replace ACL on single file or folder------- 
       $chkfile=$ofs.fileexists($filenm) ; make sure file exists
            
       IF $chkfile=true
             $changeacls $filenm, $permspart, "REPLACE", "FILE"
       ELSE
             $chkfolder=$ofs.folderexists($filenm) ; if its not a file, is it a folder?
             IF $chkfolder=true
                   $changeacls $filenm, $permspart, "REPLACE", "FOLDER"
             ENDIF
       ENDIF
            
       $ofs=nothing
       FUNCTION ChangeAcls($file,$perms,$redit,$ffolder)
             ;- Edit ACLS of specified file ----- 
             Const ADS_ACETYPE_ACCESS_ALLOWED = 0
             Const ADS_ACETYPE_ACCESS_DENIED = 1
             Const ADS_ACEFLAG_INHERIT_ACE = 2
             Const ADS_ACEFLAG_SUB_NEW = 9
                        
             $sd = GetSecurityDescriptor("FILE://"+$file+")"
             $dacl = $sd.discretionaryacl
             ;if flagged Replace then remove all existing aces from dacl first 
             IF ucase($redit)="REPLACE"
                   FOR EACH $existingace IN $dacl
                         $dacl.removeace $existingace
                   NEXT
             ENDIF
                        
             ;break up Perms into individual actions 
             $cmdarray=split($perms,"+")
                      
             FOR x=0 TO ubound($cmdarray)
                   $tmpvar1=$cmdarray(x)
                   IF ucase(left($tmpvar1,3))="DEL"
                         $aclaction="DEL"
                   ELSE
                         $aclaction="ADD"
                   ENDIF
                                          
                   $tmpcmdvar=left($tmpvar1,len($tmpvar1)-1)
                   $tmpcmdvar=right($tmpcmdvar,len($tmpcmdvar)-4)
                   $cmdparts=split($tmpcmdvar,":")
                   $namevar=$cmdparts(0)
                   $rightvar=$cmdparts(1)
                                          
                   ; if flagged edit, delete ACE;s belonging to user about to add an ace for 
                                      
                   IF ucase($redit)="EDIT"
                         FOR EACH existingAce IN $dacl
                               $trusteevar=existingAce.trustee
                               IF instr(trusteeVar,"\")
                                     $trunamevar=right($trusteevar,len($trusteevar)-instr($trusteevar,"\"))
                               ELSE
                                     $trunamevar=$trusteevar
                               ENDIF
                                                                            
                               $uctrunamevar=ucase($trunamevar)
                               $ucnamevar=ucase($namevar)
                                                                            
                               IF $uctrunamevar=$ucnamevar
                                     $dacl.removeace $existingace
                               ENDIF
                         NEXT
                   ENDIF
                   ; if action is to del ace then following clause skips addace 
                   IF $aclaction="ADD"
                         IF ucase($ffolder)="FOLDER"
                               ; folders require 2 aces for user (to do with inheritance) 
                               $addace $dacl, $namevar, $rightvar, ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_SUB_NEW
                               $addace $dacl, $namevar, $rightvar, ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_INHERIT_ACE
                         ELSE
                               $addace $dacl, $namevar, $rightvar, ADS_ACETYPE_ACCESS_ALLOWED,0
                         ENDIF
                   ENDIF
             NEXT
                        
             FOR EACH $ace IN $dacl
                   ; for some reason if ace includes "NT AUTHORITY" then existing ace does not get readded to dacl 
                                    
                   IF instr(ucase($ace.trustee),"NT AUTHORITY\")
                         $newtrustee=right($ace.trustee, len($ace.trustee)-instr($ace.trustee, "\"))
                         $ace.trustee=newtrustee
                   ENDIF
             NEXT
                        
             ; final sets and cleanup 
             $sd.discretionaryacl = $dacl
             $sec.setsecuritydescriptor $sd
             $sd=nothing
             $dacl=nothing
             $sec=nothing
       ENDFUNCTION
       FUNCTION addace($dacl, $trustee, $maskvar, $acetype, $aceflags)
             ; add ace to the specified dacl 
             Const RIGHT_READ = &H80000000
             Const RIGHT_EXECUTE = &H20000000
             Const RIGHT_WRITE = &H40000000
             Const RIGHT_DELETE = &H10000
             Const RIGHT_FULL = &H10000000
             Const RIGHT_CHANGE_PERMS = &H40000
             Const RIGHT_TAKE_OWNERSHIP = &H80000
                        
             $ace = CreateObject("AccessControlEntry")
             $ace.trustee = $trustee
                        
             SELECT
             CASE
                   ucase($maskvar)
                   ; specified rights so far only include FC & R. Could be expanded though 
             CASE
                   "F"
                   $ace.accessmask = RIGHT_FULL
             CASE
                   "C"
                   $ace.accessmask = RIGHT_READ OR RIGHT_WRITE OR RIGHT_EXECUTE OR      RIGHT_DELETE
             CASE
                   "R"
                   $ace.accessmask = RIGHT_READ OR RIGHT_EXECUTE
             ENDSELECT
                        
             $ace.acetype = $acetype
             $ace.aceflags = $aceflags
             $dacl.addace $ace
             $ace=nothing
       ENDFUNCTION
 ELSE
       COLOR r+/n
       ?"ADsSecurity not installed on this machine"
       COLOR w+/n
       SLEEP 2
       EXIT
 ENDIF
 EXIT

---

And Shawn, yes this destroyed my Friday evening too!

Whad'ya think?

Cheers!

- Kent

[ 13 August 2001: Message edited by: kdyer ]

Wrote Craig Paterson today and got an "interesting" response.

quote:

---

-----Original Message-----
From: Craig Paterson [mailto:craigpatersonj@hotmail.com]
Sent: Saturday, August 11, 2001 1:27 PM
To: Kent and Brynne Dyer
Subject: Re: WSH and KIX Folder and security permissions

Hi Kent,

I havent really looked into setting share permissions, but I suspect it may be able to be done through WMI. At some point while looking for other information, I remember seeing a share object with some acl functions within WMI.

hope this helps

Craig
----- Original Message -----
From: Kent and Brynne Dyer
To: craigpatersonj@hotmail.com
Sent: Sunday, August 12, 2001 2:28 AM
Subject: WSH and KIX Folder and security permissions

Mr. Paterson,

I have posted questions to others in the IT Community using pieces of your code from - http://cwashington.netreach.net/script_repository/view_scripts.asp?Index=360&ScriptType=vbscript. The responses has been pretty amazing!

This initially started out as a post to update via WSH on our network with the following goal:
(1) Create a remote folder
(2) Set the share
(3) Set the perms

The WSH version is available from - http://www.oregonclassifieds.net/cgi-local/ikonboard/topic.cgi?forum=6&topic=4 and works great!

I have since ported it over to KIX - http://kixtart.org/cgi-bin/ultimatebb.cgi?ubb=get_topic&f=2&t=002078

Do you have any ideas or suggestions to update Share Permissions? It seems that the file/folder permissions work well.


Thanks!

- Kent

---

Well.. It appears that there is light at the end of the tunnel. I know Shawn Spoke of RMTSHARE.EXE from the Resource Kit.

- Kent

Yeah - I kinda knew one can set remote share perms with WMI - the problem is that it only works on Windows 2000 Servers And I don't think there's a retro package you can install on NT (like you can with ADSI) ...

Actually - if you've got any Win2K servers - you should check-out what WMI has to offer ...

Got any ???

-Shawn

[ 12 August 2001: Message edited by: Shawn ]

Well we've installed Mobile Automation..

As part of it, I created a script that checks for WMI files. Maybe we can leverage off something here? Myself and the colleague that I am working with are using 2000 Workstations, which should have the WMI files installed.

code:

---

;INSTALL WINDOWS MANAGEMENT INSTRUMENTATION
:WMI
;CHECK TO SEE IF THE FOLDER EXISTS
$WBEMPATH="%WINDIR%\SYSTEM32\WBEM\"
$WMIFILEVER = GETFILEVERSION($WBEMPATH + "WinMgmt.exe","FILEVERSION")
;CHECK TO SEE IF THE FOLDER EXISTS
$WMICODE = Exist("$WBEMPATH")
;IF $WMICODE <> 1 OR $WMIFILEVER = "1.10.698.0000"
IF $WMICODE <> 1
RUN "@ldrive\Programs\wmint4.exe /s"
ENDIF
RETURN

---

As far as 2000 goes, we have our main DC as a 2000 Server and there no other others until the main office moves in October. Otherwise, we maybe able to do something in the 2000 Test domain that was created.

Thanks!

- Kent

Mobile Automation -

Ok - yap - there is a retro WMI for NT wksta/server found any examples of setting share perms yet ?

-Shawn

It's hot here - my brain is melting - Lonkero - help !

-Shawn