in reply to Directory level access
I would be remiss in my monk duties if I did not begin with these cautions:
Here is the first piece of the puzzle: From the Win32::AdminMisc FAQ, in the section on GetGroups:
If the 3rd parameter is an array reference then upon success the user names populate the array. If it is a hash reference then it is populated with the group name, comment, type (local or global) and if the it is a global group then the groups flags.I wrote and ran this test code:
I received this output:#!/usr/bin/perl -w use strict; use warnings 'all'; use Win32::AdminMisc; my $server = ''; # Use local machine. my %groups; Win32::AdminMisc::GetGroups($server, GROUP_TYPE_ALL, \%groups) or warn "Failed: $!, $^E"; foreach my $group (keys %groups) { printf "%s\t%s\n", $groups{$group}{type}, $group; } # Uncomment next two lines to see all data from %group hash. #use Data::Dumper; #print Dumper \%group;
global None local Replicator local Users local Backup Operators local Administrators local Guests local Power Users
What do you get when you run this code on a server that you "right-clicked and selected" on? How does it differ from what you expected?
I can add this code:and receive this output:use Win32::FileSecurity; my $filename = 'C:/WINNT/twain_32'; my %hash; Win32::FileSecurity::Get($filename,\%hash) or warn "Get failed: $!"; while ( my ( $ACL_owner, $mask ) = each %hash ) { $ACL_owner =~ s{.+\\}{}; my @perms; Win32::FileSecurity::EnumerateRights($mask, \@perms) or warn "Enumerate failed: $!"; my $ACL_owner_type = $groups{$ACL_owner}{type} || 'User'; print "$ACL_owner ($ACL_owner_type):\n"; @perms = $perms[0]; # only print one permission while testing. print "\t\t\t$_\n" foreach @perms; }
Administrators (local):
DELETE
CREATOR OWNER (User):
GENERIC_ALL
Power Users (local):
DELETE
SYSTEM (User):
DELETE
Users (local):
READ_CONTROL
I think that solves part 2 of your question. Let me know if any of my code needs further explanation.
If you will answer the question I posed above (right after the first block of output), then perhaps the answer to part 1 will be clearer to myself or another monk.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Win32 ACLs: Local vs Global groups
by blackadder (Hermit) on Jun 12, 2002 at 10:58 UTC | |
|
Re: Win32 ACLs: Local vs Global groups
by blackadder (Hermit) on Jun 13, 2002 at 11:23 UTC |