diff --git a/CHANGELOG.md b/CHANGELOG.md index c89017e..ed30f29 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -207,6 +207,15 @@ The format is based on Operators. It now uses the local authorization manager of this computer when the remote one refuses the user, as it already did when the remote one can't be reached. For the name of another computer, the error stays +- Fix `Get-NTFSEffectiveAccess`, which returned no access and no error when + Windows refused to start the authorization manager for the computer of + `-ServerName`, for example for a name of 32,718 characters or more: the + result looked like an account without any rights. The cmdlet now writes + a `GetEffectiveAccessError` with the error that Windows reported and + returns no result, as it does when a later step of the calculation fails. + The warning that the result is based on this computer now comes only with + a result; it also came before an error when the computer couldn't be + reached - Fix `Get-NTFSOwner`, which wrote a "The pipeline has been stopped" error for every path when a command such as `Select-Object -First 1` stopped the pipeline, and which repeated a failed read instead of reporting the diff --git a/Docs/Cmdlets/Get-NTFSEffectiveAccess.md b/Docs/Cmdlets/Get-NTFSEffectiveAccess.md index 756bfe9..ae756e0 100644 --- a/Docs/Cmdlets/Get-NTFSEffectiveAccess.md +++ b/Docs/Cmdlets/Get-NTFSEffectiveAccess.md @@ -188,6 +188,8 @@ Before 5.0.0-rc7, the warning about a computer that couldn't be reached didn't n Before 5.0.0-rc7, a user who wasn't an administrator got the error "Access is denied" and no result on a computer in a domain, also for a name of this computer, such as the default `localhost`. +Before 5.0.0-rc8, the cmdlet returned no access and no error when Windows refused to start the authorization manager for the computer of `-ServerName`, for example for a name of 32,718 characters or more, so that the result looked like an account without any rights. The cmdlet now writes a non-terminating `GetEffectiveAccessError` with the error that Windows reported and returns no result for the item, as it does for every other failure of the calculation. It warns that the result is based on this computer only when it returns a result; before 5.0.0-rc8, the warning also came before an error when the computer couldn't be reached. + ## RELATED LINKS [Get-NTFSAccess](Get-NTFSAccess.md) diff --git a/NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs b/NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs index c8468af..01ab384 100644 --- a/NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs +++ b/NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs @@ -157,7 +157,8 @@ namespace NTFSSecurity private void WriteEffectiveAccess(EffectiveAccessInfo result, object target) { - if (!result.FromRemote) + // The warning qualifies a result, which an error leaves out. Before 5.0.0-rc8, it came before the error, too. + if (!result.FromRemote && !result.OperationFailed) { // Since 5.0.0-rc7, the warning names the computer, which a command with many items can't tell otherwise. WriteWarning(string.Format("The effective rights can only be computed based on group membership on this computer, " + diff --git a/NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml b/NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml index 10c2eeb..e440a11 100644 --- a/NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml +++ b/NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml @@ -5169,6 +5169,7 @@ PS C:\> Get-NTFSAudit -SecurityDescriptor $sd Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`. When the computer of `-ServerName` couldn't be reached, the cmdlet warned that it had calculated the result on this computer, but returned no access instead of that result. Before 5.0.0-rc7, the warning about a computer that couldn't be reached didn't name the computer, and the cmdlet warned for every name of this computer except `localhost` in lowercase, such as `.`, `LOCALHOST`, or the computer name. Before 5.0.0-rc7, a user who wasn't an administrator got the error "Access is denied" and no result on a computer in a domain, also for a name of this computer, such as the default `localhost`. + Before 5.0.0-rc8, the cmdlet returned no access and no error when Windows refused to start the authorization manager for the computer of `-ServerName`, for example for a name of 32,718 characters or more, so that the result looked like an account without any rights. The cmdlet now writes a non-terminating `GetEffectiveAccessError` with the error that Windows reported and returns no result for the item, as it does for every other failure of the calculation. It warns that the result is based on this computer only when it returns a result; before 5.0.0-rc8, the warning also came before an error when the computer couldn't be reached. diff --git a/Security2/Win32/Lib.cs b/Security2/Win32/Lib.cs index 9a5c32b..67353d2 100644 --- a/Security2/Win32/Lib.cs +++ b/Security2/Win32/Lib.cs @@ -125,19 +125,15 @@ namespace Security2 try { GetEffectivePermissions_AuthzInitializeResourceManager(serverName, out remoteServerAvailable); - - try - { - GetEffectivePermissions_AuthzInitializeContextFromSid(identity); - effectiveAccess = GetEffectivePermissions_AuthzAccessCheck(sd); - } - catch (Exception ex) - { - authzException = ex; - } + GetEffectivePermissions_AuthzInitializeContextFromSid(identity); + effectiveAccess = GetEffectivePermissions_AuthzAccessCheck(sd); + } + catch (Exception ex) + { + // Also what the initialization of the resource manager throws. Before 5.0.0-rc8, that was ignored, and + // the caller got no access without an error. + authzException = ex; } - catch - { } finally { GetEffectivePermissions_FreeResouces(); @@ -148,8 +144,8 @@ namespace Security2 #region Win32 Wrapper // Whether a name of -ServerName names this computer: localhost in any case, ., the NetBIOS name, the DNS host - // name, or the fully qualified domain name. It must not throw, because GetEffectiveAccess hides every exception - // of the resource manager behind a result without access. + // name, or the fully qualified domain name. It answers false when it can't tell and doesn't throw, so that the + // fallback for a computer that can't be reached doesn't fail on this question. private static bool IsLocalComputer(string serverName) { if (string.IsNullOrEmpty(serverName)) diff --git a/Tests/Access.Tests.ps1 b/Tests/Access.Tests.ps1 index 62bc669..5b70d0f 100644 --- a/Tests/Access.Tests.ps1 +++ b/Tests/Access.Tests.ps1 @@ -169,6 +169,46 @@ Describe 'Get-NTFSEffectiveAccess' { "because the computer '' can't be reached for a remote access check. " + 'For more accurate results, calculate effective access rights on that computer.') } + + # The warning says that the result is the one of this computer, so it has no place before an error that leaves + # no result. Before 5.0.0-rc8, the cmdlet warned and then wrote the error for an account that Windows can't resolve. + It 'Should write the error and no warning about this computer for an identity that cannot be resolved' { + $identity = [Security2.IdentityReference2] 'S-1-5-21-1-2-3-1001' + $identity.AccountName | Should -BeNullOrEmpty + + $result = @(Get-NTFSEffectiveAccess -Path $effectiveFile -Account $identity -ServerName 'ntfssecurity-test.invalid' -WarningVariable accessWarnings -WarningAction SilentlyContinue -ErrorVariable accessErrors -ErrorAction SilentlyContinue) + + $result | Should -BeNullOrEmpty + $accessErrors | Should -HaveCount 1 + $accessErrors[0].FullyQualifiedErrorId | Should -BeLike 'GetEffectiveAccessError,*' + @($accessWarnings.Message | Where-Object -FilterScript { $_ -like '*can''t be reached for a remote access check*' }) | Should -BeNullOrEmpty + } + } + + # Before 5.0.0-rc8, the cmdlet ignored what the initialization of the authorization manager threw and returned no + # access without an error, which looks like an account without rights. On Windows Server 2025, a name of 32,718 + # characters or more fails there with the error 14, "Not enough memory resources are available to complete this + # operation", while a shorter name gets RPC server unavailable, and the cmdlet falls back to this computer. Another + # version of Windows may answer the long name like the short one, so the test accepts both outcomes and fails for + # no access without an error. + Context 'When Windows rejects the name of -ServerName' { + It 'Should write an error or return the result of this computer, never no access' { + $expected = Get-NTFSEffectiveAccess -Path $effectiveFile -WarningAction SilentlyContinue -ErrorAction Stop + [long] $expected.AccessRights | Should -BeGreaterThan ([long] [Security2.FileSystemRights2]::Synchronize) + + $result = @(Get-NTFSEffectiveAccess -Path $effectiveFile -ServerName ('a' * 40000) -WarningVariable accessWarnings -WarningAction SilentlyContinue -ErrorVariable accessErrors -ErrorAction SilentlyContinue) + + if ($accessErrors) { + $result | Should -BeNullOrEmpty + $accessErrors | Should -HaveCount 1 + $accessErrors[0].FullyQualifiedErrorId | Should -BeLike 'GetEffectiveAccessError,*' + @($accessWarnings.Message | Where-Object -FilterScript { $_ -like '*can''t be reached for a remote access check*' }) | Should -BeNullOrEmpty + } + else { + $result | Should -HaveCount 1 + $result[0].AccessRights | Should -Be $expected.AccessRights + } + } } # Not every computer offers the remote interface of the authorization manager; the cmdlet then calculates the result