Access denied for folder when permissions set with WMI

Question

Hi,
When I add/modify access rights based on the Win32_ACE class, there seems to be a difference in the result, then when setting it with the GUI in Windows.
The situation is as follow:
I want to set Modify access on a remote folder, but also want to avoid deletion of the folder itself. This can easily be done by setting "deny delete on this folder only" in addition to "allow modify to this folder, files and subfolders".
So far no issue.
Now I notice that, although the GUI shows exactly the same result in advanced settings of the security property, the folder set with WMI script gives a deny when opening it with the user account. The same folder, set with the same security and result in
the advanced tab, but set in the GUI, works fine.
Note: The reason that I use WMI is because the remote system is a standalone machine, not sharing the same domain or trust.
I compared the ACEFlags, AceType and AccessMask for both the GUI set and script set permissions, and they are exactly the same.
GUI => AccessMask:1179817 AceType:0 iAceFlags:3
Script => AccessMask:1179817 AceType:0 iAceFlags:3
What a strange world we live in... :-)
Any idea?

Answer 1

What Operating System Interface are you referring?  What program?
You are being obtuse. What is it that you are trying to compare. THe settings in WMI cannot be directly compared to anything in the Security Wizard.
¯\_(ツ)_/¯
Just the properties of the folder in Windows on the security tab. The result is the same for both the permissions set with the interface as well as the one set with the WMI script. The two references you see are just taken with WMI:
Set by Windows interface => AccessMask:1179817 AceType:0 iAceFlags:3 
Set by WMI script => AccessMask:1179817 AceType:0 iAceFlags:3
This are the values "AceFlags", "AceType" and "AccessMask" from management class WIN32_ACE:
http://msdn.microsoft.com/en-us/library/aa394063(v=vs.85).aspx
I just want to show that the actual ACE object returns the same values for both methods, but the effect appear to be that the script set permission are denied. And I am looking for the reason why.
Can you provide the script that you're using to create the ACE(s) and add them? If I'm understanding what you're trying to do, there should be two ACEs created: one to allow the modify access and one to deny the folder deletion. The ACE you're showing is just
an allow ACE (AceType 0).
That is correct there are (or should be) two ACEs. I cannot get hold on my source right now (will be later today), but my code is based on this source:
http://www.minasi.com/forum/topic.asp?TOPIC_ID=7501
What I basically do is getting the DACL properties, loop through it to check that the user exists that I want to update. If it does I check that the current AceType is of the same type (allow or deny) that I am updating/adding. If that type is a match, I
replace the ACE object with the new Flag, Type and Mask using a Win32_ACE object. If type type doesn't match, then I add both the current ACE with the new ACE at the same time. I noticed that if I don't do it at the same time, only the last remains. If the
user doesn't match I check that the AceFlags is not equal to 16 (inherit) and then add the original ACE object in the ACE array. At the end I add the new ACE if the user was not found at all (new). The array of individual ACE objects is added to List of managementobjects
and then again linked to the DACL value.