maxv
Wed Jan 21 08:56:49 CST 2004
WMI is your answer. You have to modify the security descriptor of the
share by removing the specified trustee. So you have to retrieve the
security descriptor and locate the trustee, then remove its ace.
If you client is XP or Win2k3, you can use IADsSecurityUtility in
conjunction with IADsSecurityDescriptor, IADsAccessControlEntry,
IADsAccessControlList interfaces.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adsi/adsi/i
adssecurityutility.asp
Sincerely,
Max Vaughn [MS]
Microsoft Developer Support
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers no rights. You assume all risk for your use.
SAMPLE CODE to work with permissions on shares using WMI:
'************************************************
Sub CheckNetworkShares
Dim oShares, objclass,objSecDescriptor
Dim share, retval, descriptor,x
LogMessage fsOut, vbCRLF & "Checking network shares..."
fsOut.Close
retval = WshShell.Run("%comspec% /c NET SHARE >> " & chr(34) & szLogFile &
chr(34),0,True)
'Reopen the text file so that logging can continue
Set fsOut = fso.OpenTextFile(szLogFile, ForAppending, True)
Set oShares = GetObject("winmgmts://" & WshNetwork.ComputerName &
"/root/cimv2")_
.execquery("select * from Win32_LogicalShareSecuritySetting")
If Err.Number <> 0 Then
LogMessage fsOut, "Unable to use WMI (Windows Management Instrumentation)
to enumerate shares." & vbCRLF & _
"Please look through the log at your current shares and manually
determine the access permissions." & _
"Alternatively you can install the WMI core and rerun the script. " & _
"
http://msdn.microsoft.com/downloads/default.asp?url=/downloads/sample.asp?u
rl=/MSDN-FILES/027/001/576/msdncompositedoc.xml"
Else
For Each share in oShares
retval = share.GetSecurityDescriptor(descriptor)
If retval <> 0 Then
LogMessage fsOut, "Unable to obtain security descriptor for " &
share.Name
Else
LogMessage fsOut, "[" & share.Name & "]"
For x = 0 to UBound(descriptor.DACL)
LogMessage fsOut, " " & descriptor.DACL(x).Trustee.Name & ":"
If descriptor.DACL(x).AccessMask and 342 Then
LogMessage fsOut, " This user has write, delete, or
execute permissions on this share."
Else
LogMessage fsOut, " This share is protected from this
user."
End If
Next
End If
Next
End If
End Sub