Gerry Hickman
2009-02-07 17:05:54 UTC
Hi,
Vista/Win2008
I think there is a bug in Win32_SecurityDescriptorHelper.Win32SDToSDDL()
whereby it does not correctly show the INHERITED_ACE AceFlag.
cacls "c:\program files\microsoft.net" /s
D:AI(A;ID;FA;;;S-1-5-80-956008885-3418522649-183
1038044-1853292631-2271478464)
(A;CIIOID;GA;;;S-1-5-80-956008885-3418522649-18310
38044-1853292631-2271478464)
(A;ID;FA;;;SY)
(A;OICIIOID;GA;;;SY)
(A;ID;FA;;;BA)
(A;OICIIOID;GA;;;BA)
(A;ID;0x1200a9;;;BU)
(A;OICIIOID;GXGR;;;BU)
(A;OICIIOID;GA;;;CO)
Note the "ID" string in the output above. CACLS correctly shows the
INHERITED_ACE flag
Now using WMI (code below) the string reads:
O:SYG:SYD:AI
(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478
464)
(A;CIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)
(A;;FA;;;SY)
(A;OICIIO;GA;;;SY)
(A;;FA;;;BA)
(A;OICIIO;GA;;;BA)
(A;;0x1200a9;;;BU)
(A;OICIIO;GXGR;;;BU)
(A;OICIIO;GA;;;CO)
Note that the "ID" string is MISSING from the output above.
function _sd2sddl(oSd) {
// Convert a security descriptor to an SDDL string
// Accept sd
// Return string
if (oSd.Path_.Class != "Win32_SecurityDescriptor") {
_trace("Object is not a Security Descriptor!");
return "Error";
}
// Set up the helper object, SDDL on Vista only!
var oHelper = oSvc.Get("Win32_SecurityDescriptorHelper");
var oInParam =
oHelper.Methods_("Win32SDToSDDL").InParameters.SpawnInstance_();
oInParam.Properties_.Item("Descriptor").Value = oSecurityDescriptor;
var oOut = oHelper.ExecMethod_("Win32SDToSDDL", oInParam);
if (oOut.ReturnValue != 0) {
_trace("Error getting SDDL string! " + oOut.ReturnValue);
return "Error";
}
return oOut.SDDL;
}
Vista/Win2008
I think there is a bug in Win32_SecurityDescriptorHelper.Win32SDToSDDL()
whereby it does not correctly show the INHERITED_ACE AceFlag.
cacls "c:\program files\microsoft.net" /s
D:AI(A;ID;FA;;;S-1-5-80-956008885-3418522649-183
1038044-1853292631-2271478464)
(A;CIIOID;GA;;;S-1-5-80-956008885-3418522649-18310
38044-1853292631-2271478464)
(A;ID;FA;;;SY)
(A;OICIIOID;GA;;;SY)
(A;ID;FA;;;BA)
(A;OICIIOID;GA;;;BA)
(A;ID;0x1200a9;;;BU)
(A;OICIIOID;GXGR;;;BU)
(A;OICIIOID;GA;;;CO)
Note the "ID" string in the output above. CACLS correctly shows the
INHERITED_ACE flag
Now using WMI (code below) the string reads:
O:SYG:SYD:AI
(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478
464)
(A;CIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)
(A;;FA;;;SY)
(A;OICIIO;GA;;;SY)
(A;;FA;;;BA)
(A;OICIIO;GA;;;BA)
(A;;0x1200a9;;;BU)
(A;OICIIO;GXGR;;;BU)
(A;OICIIO;GA;;;CO)
Note that the "ID" string is MISSING from the output above.
function _sd2sddl(oSd) {
// Convert a security descriptor to an SDDL string
// Accept sd
// Return string
if (oSd.Path_.Class != "Win32_SecurityDescriptor") {
_trace("Object is not a Security Descriptor!");
return "Error";
}
// Set up the helper object, SDDL on Vista only!
var oHelper = oSvc.Get("Win32_SecurityDescriptorHelper");
var oInParam =
oHelper.Methods_("Win32SDToSDDL").InParameters.SpawnInstance_();
oInParam.Properties_.Item("Descriptor").Value = oSecurityDescriptor;
var oOut = oHelper.ExecMethod_("Win32SDToSDDL", oInParam);
if (oOut.ReturnValue != 0) {
_trace("Error getting SDDL string! " + oOut.ReturnValue);
return "Error";
}
return oOut.SDDL;
}
--
Gerry Hickman (London UK)
Gerry Hickman (London UK)