Setting permissions on a folder using WMI

[Praveen]

Hello.

I am writing some code that accepts a DFS Link and Username and grants that
User permissions to the physical directory that the DFS Link corresponds to.
I am using the System.Manageme nt namespace and WMI queries.

When I run the code below and check the Security tab of the folder , I find
that all entries have been cleared – which is ok and this is expected, main
problem is that the User that I have set up the Trustee and ACE object for,
has not been added. Interestingly (just before I set the permissions) I
retrieve the first ACE in the access list and then add it back into the
DACL[] property of the SecurityDescrip tor object. In the code below, this
where I add ‘firstAce’ to the DACL property instead of ‘Ace’. When I check
the folder, the entry is added to the list.

I can probably assume that the code that actually sets the permissions does
work. What must be going wrong is either the way I have configured the
Trustee or the ACE object. The user to which we need to set permissions for
can be identified by the SID. I recover the SIDString using a WMI query,
passing in the Username and Domain, and then convert the resultant string
value into a byte array (SID needs to be in this format). I do this
conversion using the ASCIIEncoding class of System.Text, perhaps this is
where things are going wrong. Is there a more effective way of converting
from String to Byte Array?

Any thoughts on where there could be issues ?

Thanks,

Praveen.

Here is the code below:

//***TRUSTEE***

//Create Trustee management object (Win32_Trustee) setting the SID
(converted to byte array) and Username

ManagementObjec t Trustee = new ManagementClass (new
ManagementPath( "Win32_Trustee" ),null).CreateI nstance();

Trustee["SID"] = bSID; //SID as a byte array
//***ACE***

//Create ACE management object (Win32_ACE) setting the AccessMask, AceFlags,
AceType and Trustee (to Trustee object)

ManagementObjec t Ace = new ManagementClass (new
ManagementPath( "Win32_ACE"),nu ll).CreateInsta nce();

Ace["AccessMask "] = "2032127";

Ace["AceFlags"] = "3";

Ace["AceType"] = 0;

Ace["Trustee"] = Trustee;

//***SecurityDesc riptor***

//Retrieve the Security Descriptor passing in the path to the physical
directory

string dirClassPath1 = @"Win32_Logical FileSecuritySet ting='" + strDFSLink +
"'";

ManagementObjec t Win32LogicalFil eSecuritySettin g = new ManagementObjec t(new
ManagementPath( dirClassPath1), null);

ManagementBaseO bject outParams1 =
Win32LogicalFil eSecuritySettin g.InvokeMethod( "GetSecurityDes criptor",null,
null);

ManagementBaseO bject SecurityDescrip tor1 = (ManagementBase Object)
outParams1["Descriptor "];

//Get the first ACE in the existing DACL for this folder

ManagementBaseO bject firstAce = ((ManagementBas eObject[])
SecurityDescrip tor1["DACL"])[0];

//Set parameters for Security Descriptor

SecurityDescrip tor1["ControlFla gs"] = "4";

SecurityDescrip tor1["DACL"] = new object[1]{Ace};

//ALTERNATIVELY SET TO THE FIRST ENTRY IN THE EXISTING DACL

//SecurityDescrip tor1["DACL"] = new object[1]{firstAce};
//***Set Permissions

string dirClassPath2 = @"Win32_Directo ry='" + strDFSLink + "'";

ManagementObjec t Win32Directory = new ManagementObjec t(new
ManagementPath( dirClassPath2), null);

ManagementBaseO bject inParams2 =
Win32Directory. GetMethodParame ters("ChangeSec urityPermission s");

inParams2["Option"] = "4";

inParams2["SecurityDescri ptor"] = SecurityDescrip tor1;

ManagementBaseO bject outParams2 =
Win32Directory. InvokeMethod("C hangeSecurityPe rmissions", inParams2, null);