Re: API to change "Allow inheritable permissions...

From: Nick Finco [MSFT] (nfinco_at_online.microsoft.com)
Date: 07/01/03 

Date: Tue, 1 Jul 2003 11:09:44 -0700

Use GetNamedSecurityInfo to grab the DACL or SACL of the object. Then use
GetAce to retrieve each ACE until you find the one you are trying to modify.
Once you have found the ACE, type-cast it to a ACE_HEADER (you most likely
already did this to determine the ACE type). Then modify the AceFlags field
to include the correct flag. Pass the security descriptor you retrieved
into SetNamedSecurityInfo to set the modified ACL onto the object.

You could also pass the security descriptor returned from
GetNamedSecurityInfo into ConvertSecurityDescriptorToSecurityDescriptor,
modify the SDDL string to reflect the new flags, convert the string back
into a security descriptor
(ConvertSecurityDescriptorToStringSecurityDescriptor), and use
SetNamedSecurityInfo like above.

N 

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
Any included code samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Tim Bedford" <tim.bedford@ttplabtech.com> wrote in message
news:uckEQj#PDHA.3020@TK2MSFTNGP10.phx.gbl...
> Hi,
> Windows 2000: Under the Security tab in the right-click, file/dir
properties
> dialog thing there's a checkbox to "Allow inheritable permissions from
> parent to propagate to this object".
>
> How do you do this programmatically? I've tried using the flags in the
> AddAccessAllowedAceEx call on the object in question and its parent object
> but can't get it to work.
>
> Sorry if this questions been asked a thousand times already.
> thanks for any help,
>
> Tim
>
>
>
>

Relevant Pages

  • Re: WMI Config Error Installing SQL2K5 Standard Edition
    ... for the trustee. ... operations to fail! ... security descriptor and adding the ACE. ...
    (microsoft.public.windowsxp.wmi)
  • Re: Programming the User-Account_Property using C#
    ... Using the security descriptor get the DACL for the object. ... Create an ACE and add: ... Set Security Descriptor for the object. ... I can't see how to get to the ACEs from the DirectoryEntry ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Programming the User-Account_Property using C#
    ... Using the security descriptor get the DACL for the object. ... Create an ACE and add: ... I am trying not to use ADSI in my new program, ... I don't want to have to write a wrapper for my existing unmanaged code ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Programming the User-Account_Property using C#
    ... It looks like I've found what I need for creating the mailboxes to save you ... Using the security descriptor get the DACL for the object. ... Create an ACE and add: ... I can't see how to get to the ACEs from the DirectoryEntry ...
    (microsoft.public.dotnet.languages.csharp)