GetNamedSecurit yInfo - Read Owner

[Dave Coate]

Hi everyone,

I am looking for a way to 'override' file security and read the Owner of
a file to which I have no access. I am a system administrator, as such I
have administrative rights to all the computers in the company. Some of my
user base has full control rights to their files and have elected to remove
my access to some files. It is possible for an administrator to regain
access, but it is a messy process and can be time consuming. I have had more
than one long night copying data to a larger partition having to wach the
job for files that will not copy and go back to clean it up.

I have written a vb.net program that uses Windows API functions to
automate this. It takes ownership of problem files, grants administrative
access, copies the file or folder plus the security information and then
sets everything back the way it was. There is only one hitch. I have been
unsuccessful reading the owner of a file using Win APIs such as
GetNamedSecurit yInfo when I do not have access to the file. I can WRITE a
new owner to such a file, but not read it. I need to be able to do this so I
can subsequently restore the original owner after I copy the file.

My current work around is to make a command shell call to fileacl.exe.
This utility will read a file's owner regardless of permissions if you use
the /force switch. This works, but I am not very happy with it and I would
like to do the whole job with Win APIs. For one thing it makes the program
more portable because I do not need to remember to have the fileacl.exe
utility on every server/computer from which I run this program.

Since the fileacl utility does read the file owner without permissions,
it must be possible. Can anyone give me a hint on how this might be
accomplished?

Dave Coate

[Mattias Sjögren]

Dave,

Since the fileacl utility does read the file owner without permissions,
it must be possible. Can anyone give me a hint on how this might be
accomplished ?

I believe you have to enable the SeBackupPrivile ge.

Mattias

--
Mattias Sjögren [MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.

[Dave Coate]

I thought it might be something like that. Can you give a quick overview of
how to do that? What commands do I use? Is the privilege granted to the user
running the process or to the Security Descriptor?

"Mattias Sjögren" <ma************ ********@mvps.o rg> wrote in message
news:u3******** **********@tk2m sftngp13.phx.gb l...

Dave,

Since the fileacl utility does read the file owner without permissions,it must be possible. Can anyone give me a hint on how this might be
accomplished ?

I believe you have to enable the SeBackupPrivile ge.

Mattias

--
Mattias Sjögren [MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.

[Robert Jordan]

Dave Coate wrote:

I thought it might be something like that. Can you give a quick overview of
how to do that? What commands do I use? Is the privilege granted to the user
running the process or to the Security Descriptor?

Since SeBackupPrivile ge it's a privilege, it has to be granted
to process.

I'm not a sys admin, but there is a (usually empty) "Backup Operators"
role/group that *probably* already has this privilege.
Make yourself a member of this group and try to access the files.

bye
Rob

[Mattias Sjögren]

Dave,

I thought it might be something like that. Can you give a quick overview of
how to do that? What commands do I use? Is the privilege granted to the user
running the process or to the Security Descriptor?

<disclaimer>I 'm definitely not a security expert.</disclaimer>

I believe you use the OpenThreadToken and AdjustTokenPriv ileges APIs.
The privilege is granted to the user (admins).

See http://support.microsoft.com/?kbid=318744 for some VB6 code that
may help you get started.

Mattias

--
Mattias Sjögren [MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.

[Dave Coate]

Rob and Mattias,

I am already an administrator on all systems. That should give me the
same privileges as Backup Operators and more. However, I tested both of your
suggestions. Placing my account in the Backup Operators group did not help.
I managed to adapt the code from the link Mattias suggested. It runs in
vb.net without error, but I still can not read the owner of a file to which
I have no acess. I can change the owner to anything I want, but I can not
read it. Any more ideas? Anyone?

Dave

"Mattias Sjögren" <ma************ ********@mvps.o rg> wrote in message
news:%2******** ********@TK2MSF TNGP09.phx.gbl. ..

Dave,

I thought it might be something like that. Can you give a quick overview ofhow to do that? What commands do I use? Is the privilege granted to the userrunning the process or to the Security Descriptor?

<disclaimer>I 'm definitely not a security expert.</disclaimer>

I believe you use the OpenThreadToken and AdjustTokenPriv ileges APIs.
The privilege is granted to the user (admins).

See http://support.microsoft.com/?kbid=318744 for some VB6 code that
may help you get started.

Mattias

--
Mattias Sjögren [MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.

[Mattias Sjögren]

Dave,

Any more ideas? Anyone?

I've tried it myself now and I couldn't get GetNamedSecurit yInfo to
work either. But opening the file with
CreateFile(FILE _FLAG_BACKUP_SE MANTICS) and then calling
GetSecurityInfo on the file handle works.

Mattias

--
Mattias Sjögren [MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.

[Dave Coate]

Yes, it does work. Outstanding Mattias!

"Mattias Sjögren" <ma************ ********@mvps.o rg> wrote in message
news:%2******** **********@TK2M SFTNGP15.phx.gb l...

Dave,

Any more ideas? Anyone?

I've tried it myself now and I couldn't get GetNamedSecurit yInfo to
work either. But opening the file with
CreateFile(FILE _FLAG_BACKUP_SE MANTICS) and then calling
GetSecurityInfo on the file handle works.

Mattias

--
Mattias Sjögren [MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.