Merge pull request #127 from raandree/ai/fix-effective-access-init-errors

fix(access): report what the initialization of the authorization manager throws, and prepare 5.0.0-rc8

CHANGELOG.md

@@ -89,6 +89,14 @@ The format is based on
   `-ErrorAction Stop`
 - Name the computer in the warning of `Get-NTFSEffectiveAccess` when the
   computer of `-ServerName` can't be reached
+- Document that `Get-NTFSHardLink` and `New-NTFSHardLink -PassThru` fail for
+  a path whose root isn't the root of the volume that holds the file, such
+  as a path on a drive made with `subst`. `Get-NTFSHardLink` writes a
+  `FileNotFound` error for a file that exists, and
+  `New-NTFSHardLink -PassThru` creates the link and then stops with a
+  `FileNotFoundException`. A volume that is mounted into a folder, and a
+  junction or symbolic link to another volume, probably fail the same way.
+  Use a path that starts at the root of the volume
 
 ### Deprecated
 
@@ -207,6 +215,15 @@ The format is based on
   Operators. It now uses the local authorization manager of this computer when
   the remote one refuses the user, as it already did when the remote one can't
   be reached. For the name of another computer, the error stays
+- Fix `Get-NTFSEffectiveAccess`, which returned no access and no error when
+  Windows refused to start the authorization manager for the computer of
+  `-ServerName`, for example for a name of 32,718 characters or more: the
+  result looked like an account without any rights. The cmdlet now writes
+  a `GetEffectiveAccessError` with the error that Windows reported and
+  returns no result, as it does when a later step of the calculation fails.
+  The warning that the result is based on this computer now comes only when
+  the cmdlet calculated a result; it also came before an error when the
+  computer couldn't be reached
 - Fix `Get-NTFSOwner`, which wrote a "The pipeline has been stopped" error
   for every path when a command such as `Select-Object -First 1` stopped the
   pipeline, and which repeated a failed read instead of reporting the

Docs/Cmdlets/Get-NTFSEffectiveAccess.md

@@ -188,6 +188,8 @@ Before 5.0.0-rc7, the warning about a computer that couldn't be reached didn't n
 
 Before 5.0.0-rc7, a user who wasn't an administrator got the error "Access is denied" and no result on a computer in a domain, also for a name of this computer, such as the default `localhost`.
 
+Before 5.0.0-rc8, the cmdlet returned no access and no error when Windows refused to start the authorization manager for the computer of `-ServerName`, for example for a name of 32,718 characters or more, so that the result looked like an account without any rights. The cmdlet now writes a non-terminating `GetEffectiveAccessError` with the error that Windows reported and returns no result for the item, as it does for every other failure of the calculation. It warns that the result is based on this computer only when it calculated a result; before 5.0.0-rc8, the warning also came before an error when the computer couldn't be reached.
+
 ## RELATED LINKS
 
 [Get-NTFSAccess](Get-NTFSAccess.md)

Docs/Cmdlets/Get-NTFSHardLink.md

@@ -104,6 +104,8 @@ Hard links exist only within a single NTFS volume. Every object that this cmdlet
 
 Windows can't list the names of a file on a network share, also when the share lies on an NTFS volume of the file server. For such a file the cmdlet writes a non-terminating `GetHardLinkError` with the message "The request is not supported" and continues with the next path; run the cmdlet on the file server itself instead. Before 5.0.0, a file on a network share and a folder stopped the cmdlet with a terminating error, so that it skipped the remaining paths.
 
+The cmdlet combines the names that the file system reports with the root of the path that you pass in, which is right only when that root is the root of the volume that holds the file. For a path on a drive that you made with `subst`, the cmdlet writes a non-terminating `FileNotFound` error for a file that exists and returns no object; use `D:\Data\Report.txt` instead of `Z:\Report.txt` for the drive `Z:` that `subst Z: D:\Data` made. A volume that is mounted into a folder, and a junction or a symbolic link to another volume, probably behave the same way. Use a path that starts at the root of the volume.
+
 Because all hard links of a file share the same data, they also share the file content, the file size, and the time stamps. The security descriptor is stored with the file as well, so changing permissions through one name changes them for every name.
 
 The cmdlet resolves paths through the AlphaFS library and therefore also works with paths that exceed the 260-character `MAX_PATH` limit.

Docs/Cmdlets/New-NTFSHardLink.md

@@ -150,6 +150,8 @@ Windows supports hard links only for files on the same NTFS volume. A link that
 
 The cmdlet creates hard links on a network share as well, but Windows can't list the names of a file there. With `-PassThru` on a share, the cmdlet creates the link and writes a non-terminating `GetHardLinkError` with the message "The request is not supported" instead of the objects. Before 5.0.0, it stopped with a terminating error after it had created the link.
 
+With `-PassThru`, the cmdlet lists the names of the file like `Get-NTFSHardLink` and has its limit: when the root of `-Path` isn't the root of the volume that holds the file, such as for a drive that you made with `subst`, the cmdlet creates the link and then stops with a terminating `System.IO.FileNotFoundException`. The objects are missing, and the links that follow in the pipeline aren't created. A volume that is mounted into a folder, and a junction or a symbolic link to another volume, probably behave the same way. Use a path that starts at the root of the volume, or leave out `-PassThru`.
+
 The cmdlet does not overwrite anything. If `-Path` already exists, if `-Target` is missing or is a folder, or if a path contains a character that Windows doesn't allow, such as `|`, the cmdlet writes a non-terminating `CreateHardLinkError` with the category `ResourceExists`, `ObjectNotFound`, or `InvalidArgument`, leaves the file system unchanged, and continues with the next object from the pipeline. It checks `-Path` before `-Target`, and the error for an existing `-Path`, a missing `-Target`, or a folder as `-Target` names that path. When Windows refuses the link, such as for a target on another volume, the cmdlet writes a `CreateHardLinkError` as well.
 
 Because all names of a file share the same data, the number of hard links is a property of the file, not of an individual name. Use `Get-NTFSHardLink` to list them, and delete a link with `Remove-Item2` or `Remove-Item`, which removes only that name as long as other names remain.

NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs

@@ -157,7 +157,8 @@ namespace NTFSSecurity
 
         private void WriteEffectiveAccess(EffectiveAccessInfo result, object target)
         {
-            if (!result.FromRemote)
+            // The warning qualifies a result, which an error leaves out. Before 5.0.0-rc8, it came before the error, too.
+            if (!result.FromRemote && !result.OperationFailed)
             {
                 // Since 5.0.0-rc7, the warning names the computer, which a command with many items can't tell otherwise.
                 WriteWarning(string.Format("The effective rights can only be computed based on group membership on this computer, " +

NTFSSecurity/NTFSSecurity.psd1

@@ -102,7 +102,7 @@
             ProjectUri   = 'https://github.com/raandree/NTFSSecurity'
             ReleaseNotes = 'https://github.com/raandree/NTFSSecurity/blob/master/CHANGELOG.md'
             # Remove the prerelease label for the final release, see Docs/Contributing/05-Releasing.md
-            Prerelease   = 'rc7'
+            Prerelease   = 'rc8'
         }
     }
 }

NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml

@@ -5169,6 +5169,7 @@ PS C:\&gt; Get-NTFSAudit -SecurityDescriptor $sd</dev:code>
         <maml:para>Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`. When the computer of `-ServerName` couldn't be reached, the cmdlet warned that it had calculated the result on this computer, but returned no access instead of that result.</maml:para>
         <maml:para>Before 5.0.0-rc7, the warning about a computer that couldn't be reached didn't name the computer, and the cmdlet warned for every name of this computer except `localhost` in lowercase, such as `.`, `LOCALHOST`, or the computer name.</maml:para>
         <maml:para>Before 5.0.0-rc7, a user who wasn't an administrator got the error "Access is denied" and no result on a computer in a domain, also for a name of this computer, such as the default `localhost`.</maml:para>
+        <maml:para>Before 5.0.0-rc8, the cmdlet returned no access and no error when Windows refused to start the authorization manager for the computer of `-ServerName`, for example for a name of 32,718 characters or more, so that the result looked like an account without any rights. The cmdlet now writes a non-terminating `GetEffectiveAccessError` with the error that Windows reported and returns no result for the item, as it does for every other failure of the calculation. It warns that the result is based on this computer only when it calculated a result; before 5.0.0-rc8, the warning also came before an error when the computer couldn't be reached.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -5306,6 +5307,7 @@ PS C:\&gt; Get-NTFSAudit -SecurityDescriptor $sd</dev:code>
       <maml:alert>
         <maml:para>Hard links exist only within a single NTFS volume. Every object that this cmdlet returns therefore refers to a path on the volume of the file that you passed in.</maml:para>
         <maml:para>Windows can't list the names of a file on a network share, also when the share lies on an NTFS volume of the file server. For such a file the cmdlet writes a non-terminating `GetHardLinkError` with the message "The request is not supported" and continues with the next path; run the cmdlet on the file server itself instead. Before 5.0.0, a file on a network share and a folder stopped the cmdlet with a terminating error, so that it skipped the remaining paths.</maml:para>
+        <maml:para>The cmdlet combines the names that the file system reports with the root of the path that you pass in, which is right only when that root is the root of the volume that holds the file. For a path on a drive that you made with `subst`, the cmdlet writes a non-terminating `FileNotFound` error for a file that exists and returns no object; use `D:\Data\Report.txt` instead of `Z:\Report.txt` for the drive `Z:` that `subst Z: D:\Data` made. A volume that is mounted into a folder, and a junction or a symbolic link to another volume, probably behave the same way. Use a path that starts at the root of the volume.</maml:para>
         <maml:para>Because all hard links of a file share the same data, they also share the file content, the file size, and the time stamps. The security descriptor is stored with the file as well, so changing permissions through one name changes them for every name.</maml:para>
         <maml:para>The cmdlet resolves paths through the AlphaFS library and therefore also works with paths that exceed the 260-character `MAX_PATH` limit.</maml:para>
       </maml:alert>
@@ -7190,6 +7192,7 @@ PS C:\Data&gt; Get-NTFSSecurityDescriptor</dev:code>
       <maml:alert>
         <maml:para>Windows supports hard links only for files on the same NTFS volume. A link that points to a file on another volume, or a target on a file system that does not implement hard links, cannot be created.</maml:para>
         <maml:para>The cmdlet creates hard links on a network share as well, but Windows can't list the names of a file there. With `-PassThru` on a share, the cmdlet creates the link and writes a non-terminating `GetHardLinkError` with the message "The request is not supported" instead of the objects. Before 5.0.0, it stopped with a terminating error after it had created the link.</maml:para>
+        <maml:para>With `-PassThru`, the cmdlet lists the names of the file like `Get-NTFSHardLink` and has its limit: when the root of `-Path` isn't the root of the volume that holds the file, such as for a drive that you made with `subst`, the cmdlet creates the link and then stops with a terminating `System.IO.FileNotFoundException`. The objects are missing, and the links that follow in the pipeline aren't created. A volume that is mounted into a folder, and a junction or a symbolic link to another volume, probably behave the same way. Use a path that starts at the root of the volume, or leave out `-PassThru`.</maml:para>
         <maml:para>The cmdlet does not overwrite anything. If `-Path` already exists, if `-Target` is missing or is a folder, or if a path contains a character that Windows doesn't allow, such as `|`, the cmdlet writes a non-terminating `CreateHardLinkError` with the category `ResourceExists`, `ObjectNotFound`, or `InvalidArgument`, leaves the file system unchanged, and continues with the next object from the pipeline. It checks `-Path` before `-Target`, and the error for an existing `-Path`, a missing `-Target`, or a folder as `-Target` names that path. When Windows refuses the link, such as for a target on another volume, the cmdlet writes a `CreateHardLinkError` as well.</maml:para>
         <maml:para>Because all names of a file share the same data, the number of hard links is a property of the file, not of an individual name. Use `Get-NTFSHardLink` to list them, and delete a link with `Remove-Item2` or `Remove-Item`, which removes only that name as long as other names remain.</maml:para>
         <maml:para>Before 5.0.0, the error for a missing `-Target` said "The target path exist", the opposite of the cause.</maml:para>

Security2/Win32/Lib.cs

@@ -125,19 +125,15 @@ namespace Security2
             try
             {
                 GetEffectivePermissions_AuthzInitializeResourceManager(serverName, out remoteServerAvailable);
-
-                try
-                {
-                    GetEffectivePermissions_AuthzInitializeContextFromSid(identity);
-                    effectiveAccess = GetEffectivePermissions_AuthzAccessCheck(sd);
-                }
-                catch (Exception ex)
-                {
-                    authzException = ex;
-                }
+                GetEffectivePermissions_AuthzInitializeContextFromSid(identity);
+                effectiveAccess = GetEffectivePermissions_AuthzAccessCheck(sd);
+            }
+            catch (Exception ex)
+            {
+                // Also what the initialization of the resource manager throws. Before 5.0.0-rc8, that was ignored, and
+                // the caller got no access without an error.
+                authzException = ex;
             }
-            catch
-            { }
             finally
             {
                 GetEffectivePermissions_FreeResouces();
@@ -148,8 +144,8 @@ namespace Security2
 
         #region Win32 Wrapper
         // Whether a name of -ServerName names this computer: localhost in any case, ., the NetBIOS name, the DNS host
-        // name, or the fully qualified domain name. It must not throw, because GetEffectiveAccess hides every exception
-        // of the resource manager behind a result without access.
+        // name, or the fully qualified domain name. It answers false when it can't tell and doesn't throw, so that the
+        // fallback for a computer that can't be reached doesn't fail on this question.
         private static bool IsLocalComputer(string serverName)
         {
             if (string.IsNullOrEmpty(serverName))

Tests/Access.Tests.ps1

@@ -169,6 +169,46 @@ Describe 'Get-NTFSEffectiveAccess' {
                 "because the computer '' can't be reached for a remote access check. " +
                 'For more accurate results, calculate effective access rights on that computer.')
         }
+
+        # The warning says that the result is the one of this computer, so it has no place before an error that leaves
+        # no result. Before 5.0.0-rc8, the cmdlet warned and then wrote the error for an account that Windows can't resolve.
+        It 'Should write the error and no warning about this computer for an identity that cannot be resolved' {
+            $identity = [Security2.IdentityReference2] 'S-1-5-21-1-2-3-1001'
+            $identity.AccountName | Should -BeNullOrEmpty
+
+            $result = @(Get-NTFSEffectiveAccess -Path $effectiveFile -Account $identity -ServerName 'ntfssecurity-test.invalid' -WarningVariable accessWarnings -WarningAction SilentlyContinue -ErrorVariable accessErrors -ErrorAction SilentlyContinue)
+
+            $result | Should -BeNullOrEmpty
+            $accessErrors | Should -HaveCount 1
+            $accessErrors[0].FullyQualifiedErrorId | Should -BeLike 'GetEffectiveAccessError,*'
+            @($accessWarnings.Message | Where-Object -FilterScript { $_ -like '*can''t be reached for a remote access check*' }) | Should -BeNullOrEmpty
+        }
+    }
+
+    # Before 5.0.0-rc8, the cmdlet ignored what the initialization of the authorization manager threw and returned no
+    # access without an error, which looks like an account without rights. On Windows Server 2025, a name of 32,718
+    # characters or more fails there with the error 14, "Not enough memory resources are available to complete this
+    # operation", while a shorter name gets RPC server unavailable, and the cmdlet falls back to this computer. Another
+    # version of Windows may answer the long name like the short one, so the test accepts both outcomes and fails for
+    # no access without an error.
+    Context 'When Windows rejects the name of -ServerName' {
+        It 'Should write an error or return the result of this computer, never no access' {
+            $expected = Get-NTFSEffectiveAccess -Path $effectiveFile -WarningAction SilentlyContinue -ErrorAction Stop
+            [long] $expected.AccessRights | Should -BeGreaterThan ([long] [Security2.FileSystemRights2]::Synchronize)
+
+            $result = @(Get-NTFSEffectiveAccess -Path $effectiveFile -ServerName ('a' * 40000) -WarningVariable accessWarnings -WarningAction SilentlyContinue -ErrorVariable accessErrors -ErrorAction SilentlyContinue)
+
+            if ($accessErrors) {
+                $result | Should -BeNullOrEmpty
+                $accessErrors | Should -HaveCount 1
+                $accessErrors[0].FullyQualifiedErrorId | Should -BeLike 'GetEffectiveAccessError,*'
+                @($accessWarnings.Message | Where-Object -FilterScript { $_ -like '*can''t be reached for a remote access check*' }) | Should -BeNullOrEmpty
+            }
+            else {
+                $result | Should -HaveCount 1
+                $result[0].AccessRights | Should -Be $expected.AccessRights
+            }
+        }
     }
 
     # Not every computer offers the remote interface of the authorization manager; the cmdlet then calculates the result

Tests/Repository.Tests.ps1

@@ -97,7 +97,7 @@ Describe 'Release metadata' {
     # The PowerShell Gallery doesn't accept a version twice. Add every published version to this list
     # (Docs/Contributing/05-Releasing.md).
     It 'Should not reuse a version that the PowerShell Gallery already has' {
-        $publishedVersions = '4.0', '4.2.2', '4.2.3', '4.2.4', '4.2.5', '4.2.6', '5.0.0-rc1', '5.0.0-rc2', '5.0.0-rc3', '5.0.0-rc4', '5.0.0-rc5', '5.0.0-rc6'
+        $publishedVersions = '4.0', '4.2.2', '4.2.3', '4.2.4', '4.2.5', '4.2.6', '5.0.0-rc1', '5.0.0-rc2', '5.0.0-rc3', '5.0.0-rc4', '5.0.0-rc5', '5.0.0-rc6', '5.0.0-rc7'
 
         $publishedVersions | Should -Not -Contain $version
     }