Query ACL

[water]

Hi AutoIt3-Gurus,

I would like to query the ACLs of some network folders. I've seen how to change ACLs but this approach uses an external program that I would have to install on every computer where my AutoIt script should run.

Is there an easier way to query ACLs when running Windows XP SP3?

Thanks in advnace

Thomas

[ptrex]

@water

Maybe this can get you going.

expandcollapse popup

$strComputer = "."
$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\cimv2")

$colItems = $objWMIService.ExecQuery('SELECT * FROM Win32_LogicalShareSecuritySetting', "WQL", 48)

For $objItem in $colItems

$strShareName = $objItem.name
    
Dim $wmiSecurityDescriptor

$wmiFileSecSetting = ObjGet("winmgmts:{impersonationLevel=impersonate}!//" & $strComputer & _
                            "/root/cimv2:Win32_LogicalShareSecuritySetting.Name='" & $strShareName & "'")
    
$RetVal = $wmiFileSecSetting.GetSecurityDescriptor($wmiSecurityDescriptor)
    If @Error Then
        ConsoleWrite("GetSecurityDescriptor failed on " & $strShareName & @CRLF)
    Else
        ConsoleWrite("GetSecurityDescriptor succeeded for " & $strShareName & @CRLF)
    EndIf

    ; Retrieve the DACL array of Win32_ACE objects.
    $DACL = $wmiSecurityDescriptor.DACL
    
    $strsid = ""

    For $wmiAce in $DACL

        ConsoleWrite( "-----------------------" & @CRLF)
        ConsoleWrite("Found ACE" & @CRLF)
        ConsoleWrite( "-----------------------" & @CRLF)
        ConsoleWrite( "Access Mask: " & $wmiAce.AccessMask & @CRLF)
        ConsoleWrite( "ACE Type: " & $wmiAce.AceType & @CRLF)

        ; Get Win32_Trustee object from ACE
        $Trustee = $wmiAce.Trustee
        ConsoleWrite( "Trustee Domain: " & $Trustee.Domain & @CRLF)
        ConsoleWrite( "Trustee Name: " & $Trustee.Name & @CRLF)

        ; Get SID as array from Trustee
        $SID = $Trustee.SID

        For $i = 0 To UBound($SID) - 1
            $strsid &= $SID[$i] & ","
        Next
        
        ConsoleWrite( "Trustee SID: {" & $strsid & "}" & @CRLF)
        ConsoleWrite(@CRLF)
    Next
Next

regards,

ptrex

[water]

Hi ptrex,

I tried your script but unfortunately it doesnt return anything.

Line: @error-@extended: Line syntax
0001: 0-0: #AutoIt3Wrapper_Run_Debug_Mode=y
0002: 0-0: $strComputer = "."
0003: 0-0: $objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\cimv2")
0005: 0-0: $colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_LogicalShareSecuritySetting", "WQL", 48)
0007: 0-0: For $objItem in $colItems

What I would like to do is present the user with a treeview (as in MS Windows Explorer) and when he clicks a network folder or subfolder or subsubfolder ... I show the Security Settings (Group- and Usernames) and in another window all the groups resolved to the Usernames.

I hope I could make myself a bit clear. I'm no native speaker and no Active Directory guru.

Thanks

Thomas