You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
|
|
|
|
using Alphaleonis.Win32.Filesystem;
|
|
|
|
|
using System.Collections.Generic;
|
|
|
|
|
using System.Linq;
|
|
|
|
|
using System.Security.AccessControl;
|
|
|
|
|
using System.Security.Principal;
|
|
|
|
|
|
|
|
|
|
namespace Security2
|
|
|
|
|
{
|
|
|
|
|
public partial class FileSystemAccessRule2
|
|
|
|
|
{
|
|
|
|
|
public static void RemoveFileSystemAccessRuleAll(FileSystemSecurity2 sd, List<IdentityReference2> accounts = null)
|
|
|
|
|
{
|
|
|
|
|
var acl = sd.SecurityDescriptor.GetAccessRules(true, false, typeof(SecurityIdentifier));
|
|
|
|
|
|
|
|
|
|
if (accounts != null)
|
|
|
|
|
{
|
|
|
|
|
acl.OfType<FileSystemAccessRule>().Where(ace => (accounts.Where(account => account == (IdentityReference2)ace.IdentityReference).Count() > 1));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
foreach (FileSystemAccessRule ace in acl)
|
|
|
|
|
{
|
|
|
|
|
sd.SecurityDescriptor.RemoveAccessRuleSpecific(ace);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public static void RemoveFileSystemAccessRuleAll(FileSystemInfo item, List<IdentityReference2> accounts = null)
|
|
|
|
|
{
|
fix: write only the sections of the security descriptor that a cmdlet changes
The access and audit cmdlets wrote the owner of an item back with the
entries they changed. For a DACL without the auto-inherit flag, Windows
returns the owner and the group even when only the DACL is read, and the
cmdlets wrote every section that the descriptor held. Without the Restore
privilege, or on a file server that refuses the owner, the write failed
with error 1307 (#34).
- Add-NTFSAccess, Clear-NTFSAccess, Add-NTFSAudit, and Clear-NTFSAudit
read only the DACL or the SACL. FileSystemSecurity2.Write(),
Remove-NTFSAccess, and Remove-NTFSAudit write only the sections they
read, which also fixes the access inheritance cmdlets.
- Read together with the SACL, the inherited entries of such a DACL lose
their inherited flag when the parent folder has no SACL, and the
cmdlets stored them as explicit copies. Get-NTFSSecurityDescriptor now
reads the DACL in a separate call.
- Set-NTFSSecurityDescriptor writes only the sections that changed since
they were read; an unchanged descriptor writes nothing (maintainer
decision of 2026-10-06).
- Clear-NTFSAudit writes nothing for an item without a SACL, and reports
an error without the Security privilege (maintainer decision).
The regression tests failed before and pass after the fix in Windows
PowerShell 5.1 and PowerShell 7, elevated and as a basic user.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>
4 weeks ago
|
|
|
// Only the DACL, so that the owner isn't written back (#34) and the inherited entries keep their flag
|
|
|
|
|
var sd = new FileSystemSecurity2(item, AccessControlSections.Access);
|
|
|
|
|
|
|
|
|
|
RemoveFileSystemAccessRuleAll(sd, accounts);
|
|
|
|
|
|
|
|
|
|
sd.Write();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
