Page 1 of 1 1
Topic Options
#154623 - 2006-01-05 09:49 PM ACL Scripting Using AdsSecurity with Succes
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
I've succesfully translated a script that might interest you all. So far I've only translated the script to a working original, I will make it fully Kix compliant and submit it to the UDF collection but I wanted to show you a (to my knowledge) first working kix script that can set correct permissions without the order being messed and inheritane done correctly (inheritance always being a problem with AdsSecurity). Enjoy
Code:

;====================================================================
;SetPerms.kix
;Translated from VBS to Kix by Arend Pronk
;Original File and explanation at:
;http://support.microsoft.com/kb/266461/en-us?ln=en-us&sd=gn&fr=0
;====================================================================
;Variable Declarations
Dim $sec
Dim $sd
Dim $Dacl
Dim $ace
Dim $ace1
Dim $ace2
Dim $oSid
Dim $sidHex

;Option Explicit

;Flags: Specifies Inheritance
$ADS_ACEFLAG_INHERIT_ACE = &2
$ADS_ACEFLAG_NO_PROPAGATE_INHERIT_ACE = &4
$ADS_ACEFLAG_INHERIT_ONLY_ACE = &8
$ADS_ACEFLAG_INHERITED_ACE = &10
$ADS_ACEFLAG_VALID_INHERIT_FLAGS = &1f
$ADS_ACEFLAG_SUCCESSFUL_ACCESS = &40
$ADS_ACEFLAG_FAILED_ACCESS = &80

;Permission Type: Allow or Deny
$ADS_ACETYPE_ACCESS_ALLOWED = &0
$ADS_ACETYPE_ACCESS_DENIED = &1

;Permissions: Read, Write, FullControl
$ADS_RIGHT_GENERIC_READ = &80000000
$ADS_RIGHT_GENERIC_WRITE = &40000000
$ADS_RIGHT_GENERIC_EXECUTE = &20000000
$ADS_RIGHT_GENERIC_ALL = &10000000

$ADS_SID_RAW = 0
$ADS_SID_HEXSTRING = 1
$ADS_SID_SAM = 2
$ADS_SID_UPN = 3
$ADS_SID_SDDL = 4
$ADS_SID_WINNT_PATH = 5
$ADS_SID_ACTIVE_DIRECTORY_PATH = 6
$ADS_SID_SID_BINDING = 7

$fldname = "C:\test2" ;<----Change this to the top folder name
$usrname = "PC-GNR-XP-1\Beheerder" ;<---Change this to the user you want to add permissions for

Dim $fso, $fldr, $fc, $f1, $fldname, $usrname

; Get instance of FileSystemObject.
$fso = CreateObject("Scripting.FileSystemObject")
ApplyPerms($fldname,$usrname)
$fldr = $fso.GetFolder($fldname)

Recurse($fldr,$usrname)

$fldr = ""
$fso = ""
? "done"
Exit 0

Function Recurse($fldr,$usrname)
Dim $subfolders, $files, $folder, $file
$subfolders = $fldr.SubFolders
$files = $fldr.Files

;Display the path and all of the folders.
? $fldr.Path

For Each $folder in $subfolders
? $folder.Name
ApplyPerms($folder.path), $usrname)
Next

;Display all of the files.
For Each $file in $files
? $file.name
ApplyPerms ($file.path), $usrname)
Next

;Recurse all of the subfolders.
For Each $folder in $subfolders
Recurse $folder, $usrname
Next

$subfolders = ""
$files = ""
EndFunction

Function ApplyPerms($path, $usrname)
$sec = CreateObject("AdsSecurity")
$sd = $sec.GetSecurityDescriptor("FILE://" + $path)
$Dacl = $sd.DiscretionaryAcl

$oSid = CreateObject("AdsSid")
? @error
$oSid.SetAs($ADS_SID_SAM, Cstr($usrname))
$sidHex = $oSid.GetAs($ADS_SID_SDDL)
? $sidHex

;----Add a new ACE so User has Full Control on Files.
$ace1 = CreateObject ("AccessControlEntry")
$ace1.Trustee = $sidHex
$ace1.AccessMask = $ADS_RIGHT_GENERIC_ALL
$ace1.AceType = $ADS_ACETYPE_ACCESS_ALLOWED
$ace1.AceFlags = $ADS_ACEFLAG_INHERIT_ACE Or $ADS_ACEFLAG_INHERIT_ONLY_ACE Or 1
$Dacl.AddAce($ace1)

;----Add a new ACE so User has Full Control on Folders.
$ace2 = CreateObject ("AccessControlEntry")
$ace2.Trustee = $sidHex
$ace2.AccessMask = $ADS_RIGHT_GENERIC_ALL
$ace2.AceType = $ADS_ACETYPE_ACCESS_ALLOWED
$ace2.AceFlags = $ADS_ACEFLAG_INHERIT_ACE Or 1
$Dacl.AddAce($ace2)

$sd.DiscretionaryAcl = $Dacl
$sec.SetSecurityDescriptor($sd)
EndFunction


Top
#154624 - 2006-01-05 10:37 PM Re: ACL Scripting Using AdsSecurity with Succes
Shawn Administrator Offline
Administrator
*****

Registered: 1999-08-13
Posts: 8611
nice. is AdsSecurity something you still need to find, download and install seperately - or have they rolled this into anything yet ?
Top
#154625 - 2006-01-05 11:15 PM Re: ACL Scripting Using AdsSecurity with Succes
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
AFAIK, it is a separate DLL.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
#154626 - 2006-01-06 07:57 AM Re: ACL Scripting Using AdsSecurity with Succes
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
It's still a separate DLL as Les said. The only official package that contrains it is the ADSI SDK 2.5 which can be found here: http://download.microsoft.com/download/2/9/7/29720925-faa3-477f-a5cd-beef80adac07/adsrtk.msi

But after months of trying every other ACL modifying program such as CACLS.exe, XCACLS.exe, XCACLS.vbs, SetACL and more I believe AdsSecurity is the best choice for scripts.

Top
#154627 - 2006-01-10 02:47 PM Re: ACL Scripting Using AdsSecurity with Succes
Arend_ Moderator Offline
MM club member
*****

Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
Ordering is still a problem, after using this script on a folder create a subfolder and look at the permissions, you will get a notice that the order is not correct. Tested with the script setting permissions on a remote computer.
Top
Page 1 of 1 1


Moderator:  Shawn, ShaneEP, Ruud van Velsen, Arend_, Jochen, Radimus, Glenn Barnas, Allen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 1737 anonymous users online.
Newest Members
StuTheCoder, M_Moore, BeeEm, min_seow, Audio
17884 Registered Users

Generated in 0.156 seconds in which 0.129 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org