Speeding up a script that checks ACLs on every folder

Question

I have a script that is looking for a very specific level of NTFS access permissions, specifically a specific SDDL. I already know that SDDL and have checked to make sure that I can submit the SDDL as a test string and compare it against a get-acl SDDL.
The problem is this takes a long time (about 4 minutes for 4300 folders) and I've been asked to search through a few hundred thousand folders. Here's the code I have so far:
$folders = gci c:\foo -Directory -Recurse
ForEach ($folder in $folders)
$path = $folder.fullname
$acl = get-acl $path
if ($acl.sddl -eq "O:BAG:DUD:PARAI(A;OICI;FA;;;BA)") {write-host -ForegroundColor Red "$path has only admins"}}
Obviously I'll want to output to something other than my screen, but essentially I'm looking for ideas to speed that up.
[email protected]

Answer 1

Go here and get the LongPath.zip file. Inside it should be a file named 'Microsoft.Experimental.IO.dll'. You can use that with the code below to get around the 248 character path limit, and it should
be pretty fast, too. Just fill in the first few variables with the information you're looking for. Note that it is possible for a security descriptor's effective access to be identical to another one that has a different SDDL string (I don't think that will
happen here, though, because of the use of the CommonSecurityDescriptor class).
This creates a C# class that uses the LongPath methods to list files and folders, and it uses the GetNamedSecurityInfo() API call along with the paths to get the binary form of the security descriptors. The searching for the SDDL happens inside of a C# method,
too, to try to speed things up. I'm not really a C# developer, so someone else could probably make this even faster. Please give it a shot, though, and let me know if it works for you:
$ExperimentalIoPath = "C:\path\to\Microsoft.Experimental.IO.dll"
$PathToSearch = "c:\path\to\search"
$SddlToFind = "O:BAG:DUD:PARAI(A;OICI;FA;;;BA)"
Add-Type -Path $ExperimentalIoPath
Add-Type @"
using System;
using System.Runtime.InteropServices;
using System.Security.AccessControl;
using System.Collections.Generic;
using Microsoft.Experimental.IO;
namespace HSG {
public class Helper {
// http://msdn.microsoft.com/en-us/library/windows/desktop/aa446645%28v=vs.85%29.aspx
[DllImport("advapi32.dll", EntryPoint = "GetNamedSecurityInfoW", CharSet = CharSet.Unicode)]
internal static extern uint GetNamedSecurityInfo(
string ObjectName,
System.Security.AccessControl.ResourceType ObjectType,
SecurityInformation SecurityInfo,
out IntPtr pSidOwner,
out IntPtr pSidGroup,
out IntPtr pDacl,
out IntPtr pSacl,
out IntPtr pSecurityDescriptor
[DllImport("advapi32.dll")]
internal static extern Int32 GetSecurityDescriptorLength(
IntPtr pSecurityDescriptor
[DllImport("kernel32.dll", SetLastError=true)]
internal static extern IntPtr LocalFree(
IntPtr hMem
[Flags]
public enum SecurityInformation : uint {
Owner = 0x00000001,
Group = 0x00000002,
Dacl = 0x00000004,
Sacl = 0x00000008
public static CommonSecurityDescriptor GetSecurityDescriptor(string path, System.Security.AccessControl.ResourceType objectType, SecurityInformation securityInformation, bool isContainer) {
IntPtr pOwner, pGroup, pDacl, pSacl, pSecurityDescriptor;
pOwner = pGroup = pDacl = pSacl = pSecurityDescriptor = IntPtr.Zero;
uint exitCode;
exitCode = GetNamedSecurityInfo(path, objectType, securityInformation, out pOwner, out pGroup, out pDacl, out pSacl, out pSecurityDescriptor);
if (exitCode != 0) {
throw new Exception((new System.ComponentModel.Win32Exception(Convert.ToInt32(exitCode))).Message);
if (pSecurityDescriptor == IntPtr.Zero) {
throw new Exception(String.Format("No security descriptor available for {0} object with path {1}", objectType, path));
byte[] binarySd;
try {
int sdSize = GetSecurityDescriptorLength(pSecurityDescriptor);
binarySd = new byte[sdSize];
Marshal.Copy(pSecurityDescriptor, binarySd, 0, sdSize);
catch(Exception e) {
throw e;
finally {
if (LocalFree(pSecurityDescriptor) != IntPtr.Zero) {
throw new Exception(String.Format("Error freeing memory for security descriptor at path {0}", path));
return new CommonSecurityDescriptor(isContainer, false, binarySd, 0);
public class LongPathFileSystemItem {
public LongPathFileSystemItem(string path, bool isContainer) {
this.Path = path;
this.IsContainer = isContainer;
public string Path { get; private set; }
public bool IsContainer { get; private set; }
public static List<LongPathFileSystemItem> GetChildItemLongPath(string path, bool recurse) {
List<LongPathFileSystemItem> results = new List<LongPathFileSystemItem>();
try {
// Get directories
foreach (string folderName in LongPathDirectory.EnumerateDirectories(path)) {
if (recurse) {
results.AddRange(GetChildItemLongPath(folderName, true));
results.Add(new LongPathFileSystemItem(folderName, true));
// Get files:
foreach (string fileName in LongPathDirectory.EnumerateFiles(path)) {
results.Add(new LongPathFileSystemItem(fileName, false));
catch (Exception e) {
// Not the best way to handle errors, but didn't want to terminate
results.Add(new LongPathFileSystemItem(string.Format("Error enumerating FS objects for '{0}': {1}", path, e.Message), false));
return results;
public static List<string> GetFileSystemObjectsWithSpecificSddl(string path, string sddl, bool recurse) {
List<string> results = new List<string>();
string currentSddl;
foreach (LongPathFileSystemItem childItem in GetChildItemLongPath(path, recurse)) {
if (childItem.Path.StartsWith("Error")) {
results.Add(childItem.Path);
continue;
try {
currentSddl = GetSecurityDescriptor(
string.Format(@"\\?\{0}", childItem.Path),
ResourceType.FileObject,
SecurityInformation.Owner | SecurityInformation.Group | SecurityInformation.Dacl,
childItem.IsContainer
).GetSddlForm(AccessControlSections.All);
catch (Exception e) {
results.Add(string.Format("Error getting security descriptor for '{0}': {1}", childItem.Path, e.Message));
continue;
if (sddl == currentSddl) {
results.Add(childItem.Path);
return results;
"@ -ReferencedAssemblies $ExperimentalIoPath
function Search-Sddl {
[OutputType([string])]
[CmdletBinding()]
param(
[string] $Path,
[string] $Sddl,
[switch] $Recurse
process {
[HSG.Helper]::GetFileSystemObjectsWithSpecificSddl($Path, $SddlToFind, $Recurse) | ForEach-Object {
if ($_ -match "^Error") { Write-Error $_ }
else { $_ }
#All of that is used to define the Search-Sddl function, which is used like this:
Search-Sddl -Path $PathToSearch -Sddl $SddlToFind -Recurse