PowerShell ACL Rights on Extraction of Creator Owner

Hello Guys.
Any help would be appreciated.
I've been assigned a task to extract the creator owner of shared folders on a window server 2003 platform.
For days , i've been searching through the web cluelessly without any fruitful result.
I've located some scripts that enables me to only extract only in the below format.
I've managed to salvage this piece of script which lies somewhere around the net.
However this script could only extract
Folder Directory . System Rights . Control Type . IdentityReference . Inherited (T/F) . Inhertiance Flags . Propagation Flag.
With the below script.
##ACL Rights Execution PowerShell Script##
$OutFile = "C:\Users\All User\Desktop\logfile.csv" ##indicates where to input your logfile##
$Header = "Folder Path,IdentityReference,AccessControlType,AccessRights,IsInherited,InheritanceFlags,PropagationFlags"
Del $OutFile
Add-Content -Value $Header -Path $OutFile
$RootPath = "\\Servername\folder" ##which directory/folder you would like to extract the acl permissions##
$Folders = dir $RootPath -recurse | where {$_.psiscontainer -eq $true}
foreach ($Folder in $Folders){
$ACLs = get-acl $Folder.fullname | ForEach-Object { $_.Access }
Foreach ($ACL in $ACLs){
$OutInfo = $Folder.Fullname + "," + $ACL.IdentityReference + "," + $ACL.AccessControlType + "," + $ACL.FileSystemRights + "," + $ACL.IsInherited + "," + $ACL.InheritanceFlags + "," + $ACL.PropagationFlags
Add-Content -Value $OutInfo -Path $OutFile
I've tried to change some of the values but it would not allow me to extract the value of the creator owner.
*Due to my poor understanding to powershell scripting because i'm not a programmer*
To define creator owner specifically as in the user who originally create the folder. Not users who are assigned full rights .

Hi,
As SenneVL said, we can get owner from the cmdlet "get-acl", please also try the script below, just a little modification:
$OutFile = "C:\Users\All User\Desktop\logfile.csv" ##indicates where to input your logfile##
$Header = "Folder Path,owner,IdentityReference,AccessControlType,AccessRights,IsInherited,InheritanceFlags,PropagationFlags"
Del $OutFile
Add-Content -Value $Header -Path $OutFile
$RootPath = "\\Servername\folder" ##which directory/folder you would like to extract the acl permissions##
$Folders = dir $RootPath -recurse | where {$_.psiscontainer -eq $true}
foreach ($Folder in $Folders){
$owner = (get-acl $Folder.fullname).owner
$ACLs = get-acl $Folder.fullname | ForEach-Object { $_.Access }
Foreach ($ACL in $ACLs){
$OutInfo = $Folder.Fullname + "," + $owner + "," + $ACL.IdentityReference + "," + $ACL.AccessControlType + "," + $ACL.FileSystemRights + "," + $ACL.IsInherited + "," + $ACL.InheritanceFlags + "," + $ACL.PropagationFlags
Add-Content -Value $OutInfo -Path $OutFile
Best Regards,
Anna

Similar Messages

  • LDAP ACL Rights

    Hi all,
    The LDAP ACL Rights are visible or only available in the Directory Server but it is not reflected when connected to the portal.  And the Roles are mainly reflected from the portal. More specifically when admin rights are assigned in the portal, that overrides the acl rights provided in the Directory server.  Can anyone clarify this how and why admin rights assigned in portal overrides the acl rights assigned in the directory server?
    Thanks in advance.
    Vijay

    hi
    please go through this link
    http://help.sap.com/saphelp_nw04/helpdata/en/eb/00954081efb90ee10000000a155106/content.htm
    please don,t forget to give points
    with regards
    subrato kundu

  • ACL rights assignment in new user script

    I've been tasked with converting an old new-user script that runs at least once a day written in VB to PowerShell. This script takes as input a CSV file we get from HR that has all necessary info and creates a user, adds them to specific groups based on
    the info in the CSV, enables their Exchange mailbox, and creates their home directory. I'm having a bit of trouble planning out the rights assignment part on the user home directory; I need to be able to add the specific user (set by variable at the beginning
    of the script) and three static groups. What is the best way to do that? I can easily grab outside modules if needed (a section of my script checks for and if necessary installs modules and adds snap-ins), but I'd rather keep this 100% PowerShell - no icacls
    or outside commands.
    Any suggestions?
    Thank you in advance.
    [email protected]

    Here's what I came up with for the File System Stuff:
    foreach ($user in $userlist)
    $samaccountname = $user.empid
    $FQN = "domain\" + $samaccountname
    $homedirpath = "\\fileserver\users\$samaccountname"
    new-item -ItemType directory -path $homedirpath -force
    #Set ACLs for user and required groups
    $homedir_acl = get-acl $homedirpath
    $acl_access1 = 'domain\HomeDirectory Admins'
    $acl_access2 = "domain\$samaccountname"
    $fullrights = "Fullcontrol"
    $modifyrights = "Modify"
    $inheritrights = "ContainerInherit,ObjectInherit"
    $rule1 = new-object system.security.accesscontrol.filesystemaccessrule ($acl_access1, $fullrights, $inheritrights, "none", "Allow")
    $rule2 = new-object system.security.accesscontrol.filesystemaccessrule ($acl_access2, $modifyrights, $inheritrights, "none", "Allow")
    $homedir_acl.addAccessRule($rule1)
    set-acl $homedirpath $homedir_acl
    $homedir_acl.addAccessRule($rule2)
    set-acl $homedirpath $homedir_acl
    #Set owner on home directory
    $owner = New-Object System.Security.Principal.NTAccount($FQN)
    $homedir_acl.setowner($owner)
    set-acl $homedirpath $homedir_acl
    [email protected]

  • Powershell & ACL permissions

    So, not sure if this is actually a PowerShell issue or a simple lack of understanding of permissions on my part. So, when you look at permissions manually you have some base permissions; Modify, Read & Execute, Read, Write, etc. You also have Special
    Permissions, like Full Control and Read Attributes.
    I have a script that is pushing out changed permissions, and 
    Get-ACL $Target | Format-List
    gives me what looks to be correct permissions. But if, for example, I do
    $ACRights = [System.Security.AccessControl.FileSystemRights]"Read, Write"
    I would expect to see Read and Write in the basic permissions via the UI, and what I get in Special permissions only, and some that I didn't expect, but that are related, like Read Attributes. So, am I actually getting the results I should, and because I
    am applying this via ACL it's all Special permissions? Or is there some other mechanism for setting simple Read & Write permissions?
    Also, my need here is to make just a few files and folders available to users in ProgramData in an office where IT has generally locked down ProgramData (which then breaks functionality of some Autodesk products this year). Autodesk suggested manually setting
    the required permissions for All Users on the files and folders, but my sense is that using Authenticated Users would be better, because it limits the permissions a bit. Or is the Authenticated Users group an old concept, and there is a better practice here?
    I wouldn't be surprised if the same technique needs to be used on some Program Files folders, as Autodesk basically works form the assumption that everyone is a Local Admin, which is just insanity in my book and I would rather target specific files for access
    rather than throwing the gates open as Autodesk wants.
    Thanks!
    Gordon

    It's probably showing up as "Special" because the access control entry isn't set to apply to sub folders and files. Container objects (folders, registry keys, AD objects, and WMI namespaces) need their ACEs to apply to their children as well in order for
    them to not show up as "special". Here's how to create an ACE that gives Read and Write permissions that apply to a folder, its sub folders (ContainerInherit), and sub files (ObjectInherit):
    New-Object System.Security.AccessControl.FileSystemAccessRule (
    "Authenticated Users",
    "Read, Write", # Access enumeration string/numeric value
    "ContainerInherit, ObjectInherit", # InheritanceFlags (apply to sub folders and files)
    "None", # PropagationFlags (None simply means that this will apply to the object)
    "Allow" # ACE type
    The reason you're seeing more rights than you expect is because "Read" is actually multiple specific access rights being combined (specifically list directory, read extended attributes, read attributes,  and read permissions). To see that it translates
    to more than one right, you can convert it to binary:
    [convert]::ToString([System.Security.AccessControl.FileSystemRights]::Read.value__, 2)
    Notice that more than one bit is set. If you want to see what each of those bits means, you can use this function:
    function TranslateRights {
    param(
    $Rights = "Read",
    [Type] $Enumeration = [System.Security.AccessControl.FileSystemRights],
    [switch] $ListAll
    # Files/folders use the same enumeration, and the numeric access masks can mean slightly different things, e.g.,
    # bit 0 set means list directory for a folder or read data for a file. For that reason, it helps to have a collection
    # of the different meanings:
    $GroupedRights = @{}
    [enum]::GetNames($Enumeration) | ForEach-Object {
    $IntValue = [int] ($_ -as $Enumeration)
    # Only interested in numbers that are powers of 2
    if ($IntValue -band ($IntValue - 1)) { return }
    if ($GroupedRights.ContainsKey($IntValue)) {
    $GroupedRights.$IntValue += $_
    else {
    $GroupedRights.$IntValue = @($_)
    $GroupedRights.GetEnumerator() | sort Name | ForEach-Object {
    if ($_.Name -band ($Rights -as $Enumeration)) {
    $Granted = $true
    else {
    $Granted = $false
    $RightsString = $_.Value -join " / "
    if ($ListAll) {
    [PSCustomObject] @{
    Bit = [System.Math]::Log($_.Name, 2)
    Rights = $RightsString
    Granted = $Granted
    elseif ($Granted) {
    $RightsString
    And you could use it like this:
    TranslateRights -Rights Modify
    TranslateRights -Rights Modify -ListAll
    TranslateRights -Rights ReadKey -Enumeration ([System.Security.AccessControl.RegistryRights]) -ListAll

  • Are page creators / owners affected by approval process

    I have a user who has created a page. The approval process for a page is setup so a content administrator approves content. However when the page creater adds an item to the page, it does not seem to go through the approval process. Is this a bug?
    Orlando Kelly
    Cayman Islands Government

    Well, the user has to be hiding in there somewhere. How did the user have the access rights to create the page in the first place? They either have to be in a top level portal administration group or have manage rights on the page group level. Both of these will have to be removed
    1) Check what groups the user is in by editing the user and scrolling down to the Exisiting Group membership section towards the bottom. Check for membership in DBA, PORTAL_ADMINISTRATION, etc. If any of those are listed, edit the corresponding group and remove that user from the group
    2) Edit the page group properties and check what access rights the user has on the page group level. If listed with anything higher than view, remove the user
    3) Check the page properties on the specific page in question and verify what access the user has on the page. It should be MANAGE ITEMS WITH APPROVAL
    Rgds/Mark M.

  • RDS 2012 R2 - How do I lockdown access to Local Computer Management and Windows Backup via Group Policy

    Greetings all,
    I am needing assistance in how to lockdown access to Local Computer Management and Windows Backup via Group Policy for users that access RDS service. I have followed this awesome guide - h t t p://w w w.it.ltsoy.com/windows/lock-down-remote-desktop-services-server-2012/
      - but it is missing two important resources that I would like to lock down.Currently, I have successfully locked down Control Panel for users via Group Policy, but I cannot find any group policy or guide on how to restrict user access
    to Computer Management (different to Server Manager). When using Win-X shortcut to open the 'Administrator's shortcuts' near the windows icon, I have locked down everything except Computer Management. Computer Management gives direct access to Disk Management,
    Shares etc, which are locked down for users. But Windows Server Backup is still accessible. Can someone please guide me on how to restrict access to both Computer Management and Windows Server Backup.
    Thanks in advance.
    Terry.

    Prevent running of Windows Server Backup
    Computer Configuration\Policies\Windows Settings\Security Settings\File System
    Right click on File System - Add File - Drill down to \System32\wbadmin.msc
    On the Database Security ACL that pops up - Remove Creator Owner, Remove Users and check Adminstrators have Full Access.
    On the Object window - choose Propagate inheritable permissions to all... (Default)

  • Could you pls explain the "Get-Acl C:/Windows | fl" output?

    Could you pls explain the "Get-Acl C:/Windows | fl" output? There are some nos. what are those indicate?
    PS C:\> Get-Acl C:/Windows | fl
    Path : Microsoft.PowerShell.Core\FileSystem::C:\Windows
    Owner : NT SERVICE\TrustedInstaller
    Group : NT SERVICE\TrustedInstaller
    Access : CREATOR OWNER Allow 268435456
    NT AUTHORITY\SYSTEM Allow 268435456
    NT AUTHORITY\SYSTEM Allow Modify, Synchronize
    BUILTIN\Administrators Allow 268435456
    BUILTIN\Administrators Allow Modify, Synchronize
    BUILTIN\Users Allow -1610612736
    BUILTIN\Users Allow ReadAndExecute, Synchronize
    NT SERVICE\TrustedInstaller Allow 268435456
    NT SERVICE\TrustedInstaller Allow FullControl
    Audit :
    Sddl : O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-185
    3292631-2271478464D:PAI(A;OICIIO;GA;;;CO)(A;OICIIO;GA;;;SY)(A;;0x1301bf;;;SY)(A;OICIIO;GA;;;BA)(A;;0x1301bf;;;
    BA)(A;OICIIO;GXGR;;;BU)(A;;0x1200a9;;;BU)(A;CIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271
    478464)(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)
    AliahMurfy

    Those numbers are
    generic access rights.
    The string representation of the access rights come from the FileSystemRights enumeration. Generic rights aren't included in that enumeration, so they show up as the numeric value. You can look up the generic mappings for lots of different objects on MSDN.
    The 3.0 beta of
    my access control module will translate generic access rights for lots of different objects, including files and folders. Here is a screenshot showing the generic rights being translated for a registry key (HKLM:\SOFTWARE) and a folder (C:\Windows):
    The helper function that does the translation is temporarily accessible in the beta version. It is called New-AdaptedAcl. You can play around with it to get a better idea of what's going on (but this command will be private before the final 3.0 version is
    released). Here's a screenshot of the helper function in action (the first command does no translation, it just gives a string representation of the numeric access mask; the second command does translation, but it doesn't merge similar ACEs with each other):

  • How to Parse this XML File and require below mentioned value as output using powershell script

    Need values for below as an output for below xml file so help me with the script:
    Under Criteria Tag-
    TimeStamp Display Value
    OID corresponding to display value for nodes "Criterion"
    Under Report Body Tag--
    name in Report Section and OID value
    <?xml version="1.0" encoding="UTF-8"?>
    <ReportOutput>
        <ReportHead>
            <Report name="Execution Action" type="detailedchanges_rpt">
                <Description></Description>
            </Report>
            <Criteria>
                <TimestampCriterion name="date" displayvalue="08/10/14 23:08">
                    <Timestamp displayvalue="08/10/14 23:08">1412780929000</Timestamp>
                </TimestampCriterion>
                <MatchCriterion name="approvalId" displayvalue="Not applied" operator="contains" />
                <MatchCriterion name="promotionComment" displayvalue="Not applied" operator="contains" />
                <SelectCriterion name="changeWindow" displayvalue="Not applied" />
                <SelectCriterion name="auditEvents" displayvalue="(Any)">
                    <String>auditEventAny</String>
                </SelectCriterion>
                <SelectCriterion name="attributeDisplay" displayvalue="Changed attributes">
                    <String>changed</String>
                </SelectCriterion>
                <SelectCriterion name="versionCompare" displayvalue="Version with current baseline">
                    <String>disabled</String>
                </SelectCriterion>
                <BooleanCriterion name="showContentDiff" displayvalue="No">
                    <Boolean value="false" />
                </BooleanCriterion>
                <BooleanCriterion name="displayUsers" displayvalue="No">
                    <Boolean value="false" />
                </BooleanCriterion>
                <BooleanCriterion name="displayPackages" displayvalue="No">
                    <Boolean value="false" />
                </BooleanCriterion>
                <BooleanCriterion name="displayCustomProperties" displayvalue="No">
                    <Boolean value="false" />
                </BooleanCriterion>
                <BooleanCriterion name="strictPackageMatch" displayvalue="No">
                    <Boolean value="false" />
                </BooleanCriterion>
                <BooleanCriterion name="displayCriteriaAtEnd" displayvalue="No">
                    <Boolean value="false" />
                </BooleanCriterion>
                <SelectCriterion name="elementExists" displayvalue="Not applied" />
                <IntegerCriterion name="maxLinesPerBlock" displayvalue="10">
                    <Integer>10</Integer>
                </IntegerCriterion>
                <NodesCriterion name="nodes" displayvalue="TripwireENT.demo.net">
                    <OID>-1y2p0ij32e8bw:-1y2p0ij32e7cu</OID>
                </NodesCriterion>
                <MatchCriterion name="nodeName" displayvalue="Not applied" operator="contains" />
                <CustomPropertiesCriterion name="nodeProps" displayvalue="Not applied" />
                <RulesCriterion name="rules" displayvalue="Critical System Files">
                    <OID>-1y2p0ij32e7q2:-1y2p0ij31snh6</OID>
                </RulesCriterion>
                <MatchCriterion name="ruleName" displayvalue="Not applied" operator="contains" />
                <MatchCriterion name="elementName" displayvalue="Not applied" operator="contains" />
                <CustomPropertiesCriterion name="elementProps" displayvalue="Not applied" />
                <CustomPropertiesCriterion name="versionProps" displayvalue="Not applied" />
                <AttributesCriterion name="attributes" displayvalue="Not applied">
                    <Integer name=".missingImpliesFailure">1</Integer>
                </AttributesCriterion>
                <ContentCriterion name="content" displayvalue="Not applied" />
                <MatchCriterion name="auditEventUserName" displayvalue="Not applied" operator="contains" />
                <IntegerCriterion name="changeType" displayvalue="Added, Modified, Removed">
                    <Integer>7</Integer>
                </IntegerCriterion>
                <SeverityRangeCriterion name="severity" displayvalue="1 - 10000">
                    <Integer name="min">1</Integer>
                    <Integer name="max">10000</Integer>
                </SeverityRangeCriterion>
                <BooleanCriterion name="currentVersionsOnly" displayvalue="Yes">
                    <Boolean value="true" />
                </BooleanCriterion>
                <TimeRangeCriterion name="timeRange" displayvalue="All time" />
                <PackagesCriterion name="packages" displayvalue="Not applied" />
                <SortCriterion name="sortNodes" displayvalue="Name, ascending" isascending="true">
                    <String>name</String>
                </SortCriterion>
                <SortCriterion name="sortRules" displayvalue="Name, ascending" isascending="true">
                    <String>name</String>
                </SortCriterion>
                <SortCriterion name="sortElements" displayvalue="Name, ascending" isascending="true">
                    <String>name</String>
                </SortCriterion>
                <SortCriterion name="sortVersions" displayvalue="Date, descending" isascending="false">
                    <String>date</String>
                </SortCriterion>
            </Criteria>
        </ReportHead>
        <ReportBody>
            <ReportSection name="TripwireENT.demo.net" category="node">
                <OID>-1y2p0ij32e8bw:-1y2p0ij32e7cu</OID>
                <String name="typeName">Windows Server</String>
                <ReportSection name="Critical System Files" category="rule">
                    <OID>-1y2p0ij32e7q2:-1y2p0ij31snh6</OID>
                    <String name="typeName">Windows File System Rule</String>
                    <ReportSection name="C:\Temp" category="element">
                        <OID>-1y2p0ij32e8dr:-1y2p0ij32e586</OID>
                        <ReportSection name="08/10/14 22:48" category="version">
                            <OID>-1y2p0ij32e8du:-1y2p0ij32e3ho</OID>
                            <Integer name="changeType">1</Integer>
                            <String name="changeTypeName">Added</String>
                            <Integer name="severity">10000</Integer>
                            <String name="severityName">High</String>
                            <Timestamp name="changeTime" displayvalue="08/10/14 22:48">1412779682000</Timestamp>
                            <String name="approvalId"></String>
                            <ReportSection name="attributes" category="attributes">
                                <ReportSection name="DACL" category="added">
                                    <String name="observed">Inherits Entries: true
    NT AUTHORITY\SYSTEM, Access Allowed:
     Standard rights:
      Full Control
      Modify
      Read &amp; Execute
      List Folder Contents
      Read
      Write
      Delete
      Read Control
      Write DAC
      Write Owner
      Synchronize
     Specific rights:
      Full Control
      Traverse Folder / Execute File
      List Folder / Read Data
      Read Attributes
      Read Extended Attributes
      Create Files / Write Data
      Create Folders / Append Data
      Write Attributes
      Write Extended Attributes
      Directory Delete Child
      Read Permissions
      Change Permissions
      Take Ownership
     Header flags:
      Object Inherit
      Container Inherit
      Inherited
    BUILTIN\Administrators, Access Allowed:
     Standard rights:
      Full Control
      Modify
      Read &amp; Execute
      List Folder Contents
      Read
      Write
      Delete
      Read Control
      Write DAC
      Write Owner
      Synchronize
     Specific rights:
      Full Control
      Traverse Folder / Execute File
      List Folder / Read Data
      Read Attributes
      Read Extended Attributes
      Create Files / Write Data
      Create Folders / Append Data
      Write Attributes
      Write Extended Attributes
      Directory Delete Child
      Read Permissions
      Change Permissions
      Take Ownership
     Header flags:
      Object Inherit
      Container Inherit
      Inherited
    BUILTIN\Users, Access Allowed:
     Standard rights:
      Read &amp; Execute
      List Folder Contents
      Read
      Read Control
      Synchronize
     Specific rights:
      Traverse Folder / Execute File
      List Folder / Read Data
      Read Attributes
      Read Extended Attributes
      Read Permissions
     Header flags:
      Object Inherit
      Container Inherit
      Inherited
    BUILTIN\Users, Access Allowed:
     Specific rights:
      Create Folders / Append Data
     Header flags:
      Container Inherit
      Inherited
    BUILTIN\Users, Access Allowed:
     Specific rights:
      Create Files / Write Data
     Header flags:
      Container Inherit
      Inherited
    CREATOR OWNER, Access Allowed:
     Generic rights:
      Generic All
     Specific rights:
      Full Control
      Traverse Folder / Execute File
      List Folder / Read Data
      Read Attributes
      Read Extended Attributes
      Create Files / Write Data
      Create Folders / Append Data
      Write Attributes
      Write Extended Attributes
      Directory Delete Child
      Read Permissions
      Change Permissions
      Take Ownership
     Header flags:
      Object Inherit
      Container Inherit
      Inherit Only
      Inherited
    </String>
                                </ReportSection>
                                <ReportSection name="Group" category="added">
                                    <String name="observed">TRIPWIREENT\None</String>
                                </ReportSection>
                                <ReportSection name="Owner" category="added">
                                    <String name="observed">BUILTIN\Administrators</String>
                                </ReportSection>
                                <ReportSection name="Read-Only" category="added">
                                    <String name="observed">false</String>
                                </ReportSection>
                                <ReportSection name="SACL" category="added">
                                    <String name="observed">(null)</String>
                                </ReportSection>
                                <ReportSection name="Type" category="added">
                                    <String name="observed">Directory</String>
                                </ReportSection>
                            </ReportSection>
                        </ReportSection>
                    </ReportSection>
                    <ReportSection name="C:\Windows\System32\drivers\etc\hosts" category="element">
                        <OID>-1y2p0ij32e8dr:-1y2p0ij32e4kp</OID>
                        <ReportSection name="08/10/14 23:08" category="version">
                            <OID>-1y2p0ij32e8du:-1y2p0ij32e3hk</OID>
                            <Integer name="changeType">2</Integer>
                            <String name="changeTypeName">Modified</String>
                            <Integer name="severity">10000</Integer>
                            <String name="severityName">High</String>
                            <Timestamp name="changeTime" displayvalue="08/10/14 23:08">1412780929000</Timestamp>
                            <String name="approvalId"></String>
                            <ReportSection name="attributes" category="attributes">
                                <ReportSection name="SHA-1" category="modified">
                                    <String name="expected">de375d8a456a7345323babee88975ca567a2d5c4</String>
                                    <String name="observed">3c5520382f91cb1cd898fee2da4eba3fa338d982</String>
                                </ReportSection>
                                <ReportSection name="Size" category="modified">
                                    <String name="expected">829</String>
                                    <String name="observed">854</String>
                                </ReportSection>
                            </ReportSection>
                        </ReportSection>
                    </ReportSection>
                </ReportSection>
            </ReportSection>
            <ReportSection name="reportTotals" category="reportTotals">
                <Integer name="summary.nodeCount">1</Integer>
                <Integer name="summary.ruleCount">1</Integer>
                <Integer name="summary.elementCount">2</Integer>
            </ReportSection>
        </ReportBody>
    </ReportOutput>

    Hi Ritehere,
    I know this is simple but am beginner in Powershell Script so I was looking for logic to go through however the output you provided is not what i am looking for and your script is too complicated, as under timestamp i wanted display value and correspoding
    to display value the OID name and then name value correspoding to that OID. May be u got it wrong.
    Thanks anyways.

  • Access rights , privileges on XML DB

    Hello,
    I would like to know where can I find information about implementing security and access rights. I have 5 folders under SCOTT/TIGER schema and would like to asign access rights to different user , ie user A can access folder A only, user B can see folder A & Folder B , so on so .
    I will appreciate your help.
    Thanks
    Syed.

    I did and here is the result
    1 select r.res.getClobVal()
    2 from resource_view r
    3* where equals_path(res,'/home/SCOTT')=1
    SQL> /
    R.RES.GETCLOBVAL()
    <Resource xmlns="http://xmlns.oracle.com/xdb/XDBResource.xsd" Hidden="false" Inv
    alid="false" Container="true" CustomRslv="false" VersionHistory="false" StickyRe
    f="true">
    <CreationDate>2003-09-11T15:53:42.672000</CreationDate>
    <ModificationDate>2003-10-01T09:08:15.456000</ModificationDate>
    <DisplayName>SCOTT</DisplayName>
    <Language>en-US</Language>
    <CharacterSet>UTF-8</CharacterSet>
    <ContentType>text/plain</ContentType>
    <RefCount>1</RefCount>
    <ACL>
    R.RES.GETCLOBVAL()
    <acl description="Protected:Readable by PUBLIC and all privileges to OWNER"
    xmlns="http://xmlns.oracle.com/xdb/acl.xsd" xmlns:dav="DAV:" xmlns:xsi="http://w
    ww.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/x
    db/acl.xsd http://xmlns.oracle.com/xdb/acl.xsd">
    <ace>
    <principal>dav:owner</principal>
    <grant>true</grant>
    <privilege>
    <all/>
    </privilege>
    </ace>
    R.RES.GETCLOBVAL()
    <ace>
    <principal>XDBADMIN</principal>
    <grant>true</grant>
    <privilege>
    <all/>
    </privilege>
    </ace>
    <ace>
    <principal>PUBLIC</principal>
    <grant>true</grant>
    <privilege>
    R.RES.GETCLOBVAL()
    <read-properties/>
    <read-contents/>
    <read-acl/>
    <resolve/>
    </privilege>
    </ace>
    </acl>
    </ACL>
    <Owner>SCOTT</Owner>
    <Creator>SYS</Creator>
    <LastModifier>SCOTT</LastModifier>
    R.RES.GETCLOBVAL()
    </Resource>
    and for /home/SCOTT/1999
    SQL> select r.res.getClobVal()
    2 from resource_view r
    3 where equals_path(res,'/home/SCOTT/1999')=1;
    R.RES.GETCLOBVAL()
    <Resource xmlns="http://xmlns.oracle.com/xdb/XDBResource.xsd" Hidden="false" Inv
    alid="false" Container="true" CustomRslv="false" VersionHistory="false" StickyRe
    f="true">
    <CreationDate>2003-09-25T11:56:18.910000</CreationDate>
    <ModificationDate>2003-09-25T11:56:21.023000</ModificationDate>
    <DisplayName>1999</DisplayName>
    <Language>en-US</Language>
    <CharacterSet>WINDOWS-1252</CharacterSet>
    <ContentType>application/octet-stream</ContentType>
    <RefCount>1</RefCount>
    <ACL>
    R.RES.GETCLOBVAL()
    <acl description="Private:All privileges to OWNER only and not accessible to
    others" xmlns="http://xmlns.oracle.com/xdb/acl.xsd" xmlns:dav="DAV:" xmlns:xsi=
    "http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.ora
    cle.com/xdb/acl.xsd http://xmlns.oracle.com/xdb/acl.xs
    d">
    <ace>
    <principal>dav:owner</principal>
    <grant>true</grant>
    <privilege>
    <all/>
    </privilege>
    R.RES.GETCLOBVAL()
    </ace>
    </acl>
    </ACL>
    <Owner>SCOTT</Owner>
    <Creator>SCOTT</Creator>
    <LastModifier>SCOTT</LastModifier>
    </Resource>
    ===========================End====================
    Hope this helped.
    Syed

  • Solved - How to take ownership and change permissions for blocked files and folders in Powershell

    Hello,
    I was trying to take ownership & fix permissions on Home Folder/My Documents structures, I ran into the common problem in PowerShell where Set-Acl & Get-Acl return access denied errors. The error occurs because the Administrators have been removed from
    file permissions and do not have ownership of the files,folders/directories. (Assuming all other permissions like SeTakeOwnershipPrivilege have been enabled.
    I was not able to find any information about someone successfully using native PS to resolve the issue.  As I was able to solve the issues surrounding Get-Acl & Set-Acl, I wanted to share the result for those still looking for an answer.
    Question: How do you use only Powershell take ownership and reset permissions for files or folders you do not have permissions or ownership of?
    Problem: 
    Using the default function calls to the object fail for a folder that the administrative account does not have permissions or file ownership. You get the following error for Get-Acl:
    PS C:\> Get-Acl -path F:\testpath\locked
    Get-Acl : Attempted to perform an unauthorized operation.
    + get-acl <<<< -path F:\testpath\locked
    + CategoryInfo : NotSpecified: (:) [Get-Acl], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetAclCommand
    If you create a new ACL and attempt to apply it using Set-Acl, you get:
    PS C:\> Set-Acl -path F:\testpath\locked -AclObject $DirAcl
    Set-Acl : Attempted to perform an unauthorized operation.
    At line:1 char:8
    + Set-Acl <<<< -path "F:\testpath\locked" -AclObject $DirAcl
    + CategoryInfo : PermissionDenied: (F:\testpath\locked:String) [Set-Acl], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand
    Use of other functions like .GetAccessControl will result in a similar error: "Attempted to perform an unauthorized operation."
    How do you replace owner on all subcontainers and objects in Powershell with resorting to external applications like takeown, icacls, Windows Explorer GUI, etc.?
    Tony

    Hello,
    Last, here is the script I used to reset permissions on the "My Documents" tree structure that admins did not have access to:
    Example:  Powershell script to parse a directory of User-owned "My Document" redirection folders and reset permissions.
    #Script to Reset MyDocuments Folder permissions
    $domainName = ([ADSI]'').name
    Import-Module "PSCX" -ErrorAction Stop
    Set-Privilege (new-object Pscx.Interop.TokenPrivilege "SeRestorePrivilege", $true) #Necessary to set Owner Permissions
    Set-Privilege (new-object Pscx.Interop.TokenPrivilege "SeBackupPrivilege", $true) #Necessary to bypass Traverse Checking
    #Set-Privilege (new-object Pscx.Interop.TokenPrivilege "SeSecurityPrivilege", $true) #Optional if you want to manage auditing (SACL) on the objects
    Set-Privilege (new-object Pscx.Interop.TokenPrivilege "SeTakeOwnershipPrivilege", $true) #Necessary to override FilePermissions & take Ownership
    $Directorypath = "F:\Userpath" #locked user folders exist under here
    $LockedDirs = Get-ChildItem $Directorypath -force #get all of the locked directories.
    Foreach ($Locked in $LockedDirs) {
    Write-Host "Resetting Permissions for "$Locked.Fullname
    #######Take Ownership of the root directory
    $blankdirAcl = New-Object System.Security.AccessControl.DirectorySecurity
    $blankdirAcl.SetOwner([System.Security.Principal.NTAccount]'BUILTIN\Administrators')
    $Locked.SetAccessControl($blankdirAcl)
    ###################### Setup & apply correct folder permissions to the root user folder
    #Using recommendation from Ned Pyle's Ask Directory Services blog:
    #Automatic creation of user folders for home, roaming profile and redirected folders.
    $inherit = [system.security.accesscontrol.InheritanceFlags]"ContainerInherit, ObjectInherit"
    $propagation = [system.security.accesscontrol.PropagationFlags]"None"
    $fullrights = [System.Security.AccessControl.FileSystemRights]"FullControl"
    $allowrights = [System.Security.AccessControl.AccessControlType]"Allow"
    $DirACL = New-Object System.Security.AccessControl.DirectorySecurity
    #Administrators: Full Control
    $DirACL.AddAccessRule((new-object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators",$fullrights, $inherit, $propagation, "Allow")))
    #System: Full Control
    $DirACL.AddAccessRule((new-object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM",$fullrights, $inherit, $propagation, "Allow")))
    #Creator Owner: Full Control
    $DirACL.AddAccessRule((new-object System.Security.AccessControl.FileSystemAccessRule("CREATOR OWNER",$fullrights, $inherit, $propagation, "Allow")))
    #Useraccount: Full Control (ideally I would error check the existance of the user account in AD)
    #$DirACL.AddAccessRule((new-object System.Security.AccessControl.FileSystemAccessRule("$domainName\$Locked.name",$fullrights, $inherit, $propagation, "Allow")))
    $DirACL.AddAccessRule((new-object System.Security.AccessControl.FileSystemAccessRule("$domainName\$Locked",$fullrights, $inherit, $propagation, "Allow")))
    #Remove Inheritance from the root user folder
    $DirACL.SetAccessRuleProtection($True, $False) #SetAccessRuleProtection(block inheritance?, copy parent ACLs?)
    #Set permissions on User Directory
    Set-Acl -aclObject $DirACL -path $Locked.Fullname
    Write-Host "commencer" -NoNewLine
    ##############Restore admin access & then restore file/folder inheritance on all subitems
    #create a template ACL with inheritance re-enabled; this will be stamped on each subitem to re-establish the file structure with inherited ACLs only.
    #$NewOwner = New-Object System.Security.Principal.NTAccount("$domainName","$Locked.name") #ideally I would error check this.
    $NewOwner = New-Object System.Security.Principal.NTAccount("$domainName","$Locked") #ideally I would error check this.
    $subFileACL = New-Object System.Security.AccessControl.FileSecurity
    $subDirACL = New-Object System.Security.AccessControl.DirectorySecurity
    $subFileACL.SetOwner($NewOwner)
    $subDirACL.SetOwner($NewOwner)
    ######## Enable inheritance ($False) and not copy of parent ACLs ($False)
    $subFileACL.SetAccessRuleProtection($False, $False) #SetAccessRuleProtection(block inheritance?, copy parent ACLs?)
    $subDirACL.SetAccessRuleProtection($False, $False) #SetAccessRuleProtection(block inheritance?, copy parent ACLs?)
    #####loop through subitems
    $subdirs = Get-ChildItem -path $Locked.Fullname -force -recurse #force is necessary to get hidden files/folders
    foreach ($subitem in $subdirs) {
    #take ownership to insure ability to change permissions
    #Then set desired ACL
    if ($subitem.Attributes -match "Directory") {
    # New, blank Directory ACL with only Owner set
    $blankdirAcl = New-Object System.Security.AccessControl.DirectorySecurity
    $blankdirAcl.SetOwner([System.Security.Principal.NTAccount]'BUILTIN\Administrators')
    #Use SetAccessControl to reset Owner; Set-Acl will not work.
    $subitem.SetAccessControl($blankdirAcl)
    #At this point, Administrators have the ability to change the directory permissions
    Set-Acl -aclObject $subDirACL -path $subitem.Fullname -ErrorAction Stop
    } Else {
    # New, blank File ACL with only Owner set
    $blankfileAcl = New-Object System.Security.AccessControl.FileSecurity
    $blankfileAcl.SetOwner([System.Security.Principal.NTAccount]'BUILTIN\Administrators')
    #Use SetAccessControl to reset Owner; Set-Acl will not work.
    $subitem.SetAccessControl($blankfileAcl)
    #At this point, Administrators have the ability to change the file permissions
    Set-Acl -aclObject $subFileACL -path $subitem.Fullname -ErrorAction Stop
    Write-Host "." -NoNewline
    Write-Host "fin."
    Write-Host "Script Complete."
    I hope you find this useful.
    Thank you,
    Tony
    Final Thought: There are great non-PS tools like
    Set-Acl and takeown which are external to PS & can also do the job wonderfully.  It may be much simpler to call those tools than recreate the wheel in pure
    code.  Feel free to use whatever best suits your time, scope & cost.

  • Read Only for all but creator of original file

    I need to accomplish the following:
     The goal is for us all to have access to read all the files associated with the audit. Only person posting the file should be able to modify it.
    Would this be:
    Everyone: Read/Write/Create
    Owner: Modify/Delete
    As right now they all can read/write/delete any document they would like.

    Ah, I see. I'll clarify: you're supposed to set these permissions on the topmost folder
    where your users are supposed to create files:
    This folder and subfolders:
    Everyone - Read and Execute, Create files
    Files only:
    Everyone - Read and Execute
    CREATOR OWNER - Modify
    The end result is that users can create files in that folder and all its subfolders - they cannot create folders, but they can read everything. Now, when a user creates a
    file in this folder structure, that user and that user only will automatically get Modify on that particular file (the CREATOR OWNER permission is translated to that user account in the ACL).
    An example:
    Let's say your topmost folder is D:\Data\Users. You apply the above permissions to
    this folder. Then, a user with the account name YOURDOMAIN\User1 comes along and creates the file "MyTasks.txt" in this folder. That file will then have the following permissions:
    Everyone - Read & Execute
    YOURDOMAIN\User1 - Modify
    As you can see, there is no need for any special groups. Try it out!

  • Access Denied for User with Contribute Rights to a SP list

    I have two users that I have given Contribute Rights on a SharePoint 2010 site - the SP list in question is inheriting permissions from the Parent site, as well as other lists in the site. These two users can edit items in the all other lists on the
    site except for this one in question.
    It is only one list that they cannot view or edit list items. They can view the items in the list, but when they try to open an item in display or edit form, it gives the access denied.
    Other users on the site are NOT having these issues - with the same permissions.
    I researched this problem and have tried various solutions with no luck. I have checked to see that there are NO item level permissions set up; I have deleted the user from the site collection, then added them back, with no luck.
    I am at a loss on what to do.
    Please help

    Timestamp               Process                                
     TID    Area                           Category                     
     EventID Level      Message  Correlation
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg4 Verbose  Groups for process identity 'DOMAIN\spadmin': 'DOMAIN\Domain Users', 'Everyone', 'SHAREPOINT\WSS_ADMIN_WPG', 'SHAREPOINT\WSS_RESTRICTED_WPG_V4', 'SHAREPOINT\WSS_WPG', 'BUILTIN\IIS_IUSRS', 'BUILTIN\Performance Monitor Users', 'BUILTIN\Users',
    'BUILTIN\Administrators', 'NT AUTHORITY\SERVICE', 'CONSOLE LOGON', 'NT AUTHORITY\Authenticated Users', 'NT AUTHORITY\This Organization', 'NT SERVICE\SPTimerV4', 'LOCAL', 'DOMAIN\Group Policy Creator Owners', 'DOMAIN\Department_Schedules_ReadWrite', 'DOMAIN\Sage50_ReadWrite',
    'DOMAIN\GrainCleaners_ReadWrite', 'DOMAIN\Domain Admins', 'DOMAIN\IT Department', 'DOMAIN\RDP_Users', 'DOMAIN\Engineering_ReadWrite', 'DOMAIN\Inventory_ReadWrite', 'DOMAIN\Schema Admins', 'DOMAIN\FabTrol', 'DOMAIN\Enterprise Admins', 'DOMAIN\Software', 'DOMAIN\Denied
    RODC Password Replication Group',  17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg1 High     Group WSS_WPG... 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_WPG: DOMAIN\spadmin 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_WPG: NT AUTHORITY\LOCAL SERVICE 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_WPG: DOMAIN\spservice 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_WPG: DOMAIN\SearchSvc 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_WPG: DOMAIN\spContent 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_WPG: DOMAIN\WebAnalProcessSvc 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_WPG: DOMAIN\svcAppPoolSecure 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_WPG: NT AUTHORITY\SYSTEM 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg1 High     Group WSS_ADMIN_WPG... 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_ADMIN_WPG: BUILTIN\Administrators 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_ADMIN_WPG: DOMAIN\spadmin 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:41:06.17  OWSTIMER.EXE (0x01E4)                    0x0AD0 SharePoint Server Search       Administration               
     dmg2 High     Group WSS_ADMIN_WPG: DOMAIN\rawtecadmin 17e8c7b4-fa35-4040-ac83-fe55f721590d
    03/11/2014 10:50:15.56  w3wp.exe (0x0098)                        0x19B8 SharePoint Foundation        
     Monitoring                     b4ly Medium   Leaving Monitored Scope (Request (GET:https://portal.emw.ca:443/ehs/Lists/InvestigationReports/DispForm.aspx?ID=40&Source=https%3A%2F%2Fportal%2Eemw%2Eca%2Fehs%2FLists%2FInvestigationReports%2FMyInvestigations%2Easpx&ContentTypeId=0x0100E352DB580E29424FB1C52A1D93E09345&IsDlg=1)).
    Execution Time=115.2334 0c90a46f-e4ea-46b5-a566-e7a9f404c0aa
    03/11/2014 10:50:15.66  w3wp.exe (0x0098)                        0x16CC SharePoint Foundation        
     Monitoring                     nasq Medium   Entering monitored scope (Request (GET:https://portal.emw.ca:443/ehs/_layouts/AccessDenied.aspx?Source=https%3A%2F%2Fportal%2Eemw%2Eca%2Fehs%2FLists%2FInvestigationReports%2FDispForm%2Easpx%3FID%3D40%26Source%3Dhttps%253A%252F%252Fportal%252Eemw%252Eca%252Fehs%252FLists%252FInvestigationReports%252FMyInvestigations%252Easpx%26ContentTypeId%3D0x0100E352DB580E29424FB1C52A1D93E09345%26IsDlg%3D1&Type=list&name=%7BD3F44F01%2DC738%2D409A%2DA491%2DDD0F905CC83B%7D&IsDlg=1)) 
    03/11/2014 10:50:15.66  w3wp.exe (0x0098)                        0x16CC SharePoint Foundation        
     Logging Correlation Data       xmnv Medium   Name=Request (GET:https://portal.emw.ca:443/ehs/_layouts/AccessDenied.aspx?Source=https%3A%2F%2Fportal%2Eemw%2Eca%2Fehs%2FLists%2FInvestigationReports%2FDispForm%2Easpx%3FID%3D40%26Source%3Dhttps%253A%252F%252Fportal%252Eemw%252Eca%252Fehs%252FLists%252FInvestigationReports%252FMyInvestigations%252Easpx%26ContentTypeId%3D0x0100E352DB580E29424FB1C52A1D93E09345%26IsDlg%3D1&Type=list&name=%7BD3F44F01%2DC738%2D409A%2DA491%2DDD0F905CC83B%7D&IsDlg=1) 9446cae0-8ef5-4ffa-aad8-798d3139a2e7

  • Resource view ACLs not updating [removed: duplicate post]

    Removed.

    An excellent suggestion and one I was just checking myself: results are NOT positive
    SQL> conn TEST/TEST
    Connected.
    SQL> select extract(res, '/Resource/Owner') owner
    from resource_view
    where any_path='/home/test/test-doc.xml'; 2 3
    OWNER
    <Owner xmlns="http://xmlns.oracle.com/xdb/XDBResource.xsd">TEST</Owner>
    SQL> select dbms_xdb.getprivileges('/home/test/test-doc.xml').getclobval() granted_privileges from dual;
    GRANTED_PRIVILEGES
    <privilege xmlns="http://xmlns.oracle.com/xdb/acl.xsd" xmlns:xsi="http://www.w3.
    org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/xdb/acl
    .xsd http://xmlns.oracle.com/xdb/acl.xsd DAV: http://xmlns.oracle.com/xdb/dav.xs
    d" xmlns:xdbacl="http://xmlns.oracle.com/xdb/acl.xsd" xmlns:dav="DAV:">
    <read-properties/>
    <read-contents/>
    <update/>
    <link/>
    <unlink/>
    <read-acl/>
    <write-acl-ref/>
    <update-acl/>
    <resolve/>
    <link-to/>
    <unlink-from/>
    <dav:lock/>
    <dav:unlock/>
    </privilege>
    Everything checks out so far, but here's the really strange one:
    SQL> select dbms_xdb.aclcheckprivileges(
    2 '/home/test/test-doc.xml',
    3 'TEST',
    4 xmltype('<privilege xmlns="http://xmlns.oracle.com/xdb/acl.xsd" xmlns:dav="dav:">
    5 <read-contents/>
    6 <read-properties/>
    7 </privilege>'))as has_privileges
    8 from dual;
    HAS_PRIVILEGES
    0
    Basically this is saying that the owner, 'TEST', does not have permissions which he most obviously does! WTH?
    I'll look into raising a TAR but I have to say that this is SO disappointing.

  • Removing modify/sync NTFS permissions using removeaccessruleall in Powershell

    Hi,
    I've got a script together which removes all non-inherited groups from a user's home folder. It's working fine until I run into groups which have modify/sync permission. Even though I'm using the removeaccessruleall permission, those groups just don't
    remove. I've attached the code I'm using below and I can provide the full script if needed.
    $objAccessRule1 = New-Object System.Security.AccessControl.FileSystemAccessRule($strAccount,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
    $objACL.RemoveAccessRuleAll($objAccessRule1)
    I'd appreciate any insight anyone can provide.
    Cheers,
    Ed Narayan
    

    Hi Rohn,
    Still no luck. The modify/sync permission still remains. Here's my code:
    import-module activedirectory
    $StrInvocation = (Get-Variable MyInvocation).Value
    $strRunDir = Split-Path $StrInvocation.MyCommand.Path
    $strDate = get-date -format "dd-MMM-yyyy-HHmm"
    # Set everyone to list folder contents - this folder only and remove extra groups on folder
    function phase1
    $strSharePath = $args[0]
    $objACL = Get-Acl $strSharePath
    # Define permissions
    $strPermission1 = "Everyone","ListDirectory","None","None","Allow"
    # Attach permissions to access rules
    $objAccessRule1 = New-Object System.Security.AccessControl.FileSystemAccessRule $strPermission1
    # Attach access rules to ACL object
    $objACL.SetAccessRule($objAccessRule1)
    $objACL.PurgeAccessRules([System.Security.Principal.NTAccount]"AccountAdmins")
    $objACL.PurgeAccessRules([System.Security.Principal.NTAccount]"SHR-MDRIVE")
    $objACL.PurgeAccessRules([System.Security.Principal.NTAccount]"SYSTEM")
    # Set access rules on ACL object
    Set-Acl $strSharePath $objACL
    # For each folder processed, turn on inheritance if it's off, remove orphaned acls and non-inherited groups
    function phase2
    [CmdletBinding()]
    Param([Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
    [string]$strFolder)
    PROCESS{
    # Set variables
    $strLog = "$strRunDir\Logs\log-$strDate.txt"
    $arrGroups = @()
    $objACEs = @()
    $objACL = get-acl $strFolder
    $objACEs = $objACL.Access | Where-Object {!$_.IsInherited} | select-object IdentityReference -unique
    [bool]$blnIsInherit = [bool](get-inheritance $strFolder | select-object -expandproperty inheritanceenabled)
    [bool]$blnGroupExists = $false
    $objChildObjects = Get-ChildItem $strFolder -recurse
    write-output "`n" | Out-file $strLog -append
    write-output "FOLDER:$strFolder `n" | Out-file $strLog -append
    write-output "Inheritance enabled - $blnIsInherit `n" | Out-file $strLog -append
    # If inheritance is turned off, enable it
    if(!$blnIsInherit)
    write-output "Enabling inheritance for $strFolder`n" | Out-file $strLog -append
    $objACL.SetAccessRuleProtection($False, $True)
    # If non-inherited permissions exist, process each of them
    if(($objACEs| Measure-Object).Count -gt 0)
    foreach($objACE in $objACEs)
    [bool]$blnIsGroup = $false
    [string]$strAccount = $objACE.IdentityReference
    if($strAccount -like "*\*")
    $arrSplit = $strAccount.split("\")
    $strAccount= $arrSplit[1]
    # Check if permission is for a group
    $blnIsGroup = [bool](get-adgroup $strAccount -erroraction silentlycontinue)
    # If permission is for a group, create an acl entry for removing it. Multiple remove entries can be created depending on the number of groups found
    if($blnIsGroup)
    Write-output "Removing:$strAccount`n" | Out-file $strLog -append
    $objACL.PurgeAccessRules([System.Security.Principal.NTAccount]$strAccount)
    if($strAccount-like "*SYSTEM*" -or $strAccount-like "*CREATOR OWNER*" -or $strAccount-like "*USERS*" -or $strAccount-like "*Administrators*" -or $strAccount-like "*S-1-5-*")
    Write-output "Removing:$strAccount`n" | Out-file $strLog -append
    $objACL.PurgeAccessRules([System.Security.Principal.NTAccount]$strAccount)
    Set-acl $strFolder $objACL
    Phase 1 changes the everyone group to list folder contents on this folder only and removes a bunch of groups from the root folder.
    Phase 2 removes all orphaned sids and non-inherited groups from the folder and turns on inheritance if it's turned off.
    At this stage, this feels like a bug within the ACL cmdlets.
    Cheers,
    Ed

  • How to determine the owner of the current package ?

    From a package (that is defined with invoker's rights: AUTHID CURRENT_USER) I want to determine the owner of that package. (We plan to deploy the same code into multiple schemas.)
    One approach would be to parse the results of DBMS_UTILITY.format_call_stack . . . any other ideas?
    Thanks,
    Mike

    mtefft wrote:
    We are using Total Recall aka Flashback Data Archive.
    If you have a Flashback Data Archive on a table, you can not drop it without removing the archive, and to do that you need ADMINISTER FLASHBACK ARCHIVE privilege. We want to give users the ability to remove the flashback archive (this is an ALTER TABLE) from their own tables without granting that privilege.
    So, we have a utilty schema which has this privilege. We created a definer-rights package to issue the alter, but it does not have ALTER ANY TABLE privilege. So, we added an invoker-rights package that the table-owner can call. This first issues GRANT ALTER ON [input-table-name] TO itself, then calls the definer-rights package, which now has both the system privilege and the object privilege needed. Why not just create a procedure owned by an "admin" user that does the alter table and grant execute on the proc to the utility schema ?
    As an example with scott and sys (using sys in a real-world system would be a Bad Idea© but I'm on a playground database on my laptop) :
    As Scott :Scott@my11g SQL>!cat createTable.sql
    create table mytable (
    id integer,
    val varchar2(30),
    constraint mytable_pk primary key(id)
    Scott@my11g SQL>@createTable
    Table created.As admin user :Sys@my11g SQL>!cat startFlashback.sql
    alter table scott.mytable flashback archive fl_archive;
    Sys@my11g SQL>alter table scott.mytable flashback archive fl_archive;
    Table altered.
    Sys@my11g SQL>select * from dba_flashback_archive_tables;
    TABLE_NAME                     OWNER_NAME                     FLASHBACK_ARCHIVE_NAME
    ARCHIVE_TABLE_NAME                                    STATUS
    MYTABLE                        SCOTT                          FL_ARCHIVE
    SYS_FBA_HIST_79498                                    ENABLEDAs admin user, I create the procedure and grant execute to scott :Sys@my11g SQL>!cat createProc.sql
    create or replace procedure remove_flarch(
    p_tabname varchar2
    is
    l_strcmd varchar2(200);
    begin
    for cur in (
    select owner, table_name from dba_tables where owner=user and table_name=upper(p_tabname)
    ) loop
    l_strcmd := 'alter table '||cur.owner||'.'||cur.table_name||' no flashback archive' ;
    execute immediate l_strcmd ;
    end loop;
    end;
    sho err
    grant execute on remove_flarch to scott;
    Sys@my11g SQL>@createProc.sql
    Procedure created.
    No errors.
    Grant succeeded.As Scott I cannot disable the flashback archive explicitly :Scott@my11g SQL>alter table mytable no flashback archive ;
    alter table mytable no flashback archive
    ERROR at line 1:
    ORA-55620: No privilege to use Flashback ArchiveBut I can do it using the procedure :Scott@my11g SQL>begin
      2  sys.remove_flarch('MYTABLE');
      3  end;
      4  /
    PL/SQL procedure successfully completed.Checking from admin point of view :Sys@my11g SQL>select * from dba_flashback_archive_tables;
    no rows selected
    mtefft wrote:All is well, except for the fact that we want to deploy this under multiple schemas. So we need to know 'to whom should the ALTER TABLE grant be given?'Just grant execute on the procedure to your different users.

Maybe you are looking for