Re: Platform SDK and AdsSecurity.dll

From: Torgeir Bakken (MVP) (Torgeir.Bakken-spam_at_hydro.com)
Date: 02/27/04 

Date: Fri, 27 Feb 2004 04:02:07 +0100

Andrew wrote:

> I downloaded the Platform SDK after reading KB article 279682, "Howto use adssecurity.dll to add an ACE to an NTFS folder". I ony downloaded the Core SDK (expecting that the DLL would be part of the Active Directory part).
> However, the DLL file was not downloaded/installed? Is there something else I need to download?
> Is there any other way to programatically list/change NTFS folder permissions?

Hi

The latest version of adssecurity.dll is in this msi file (2,5 MB):
http://download.microsoft.com/download/2/9/7/29720925-faa3-477f-a5cd-beef80adac07/adsrtk.msi

The link above is to be found as "Download the SDK for Active Directory
Services Interfaces 2.5 (English Language Version)" here:

http://www.microsoft.com/ntserver/nts/downloads/other/ADSI25/default.asp

Note this one regarding CONSTs if you are going to use IADsSecurityUtility
or adssecurity.dll from a vbscript:
http://groups.google.com/groups?threadm=3F8C7FC5.AEFF4C1D%40hydro.com

Note that for WinXP and Win2k3 Server, you should use the builtin
IADsSecurityUtility object.

It has a COM interface as well as an API interface. Note that the
AdsSecurityUtility will do a number of things for you automatically
that ADsSecurity.dll for Win2k does not, see comment from Max Vaughn
further below.

Don't let the wording "Active Directory Service Interfaces" (ADSI) fool you.
It can be used for a local computer as well.

IADsSecurityUtility
http://msdn.microsoft.com/library/en-us/adsi/adsi/iadssecurityutility.asp

Using ADSI for Setting NTFS Permissions (Part 1-3) by Marcin Policht
http://www.swynk.com/friends/policht/Art042602.asp
http://www.swynk.com/friends/policht/Art050602.asp
http://www.swynk.com/friends/policht/Art051602.asp

HOWTO: Use ADsSecurity.dll to Add an Access Control Entry to an NTFS
Folder (Q279682)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;279682

*********************************************************************
Here is the response from Max Vaughn on a similar post I made about
file/folder permission setting in this thread:
http://groups.google.com/groups?th=b3e9451478cae0d8

From: Max L. Vaughn (maxv@online.microsoft.com)
Subject: Re: Setting file premissions on a remote computer
Newsgroups: microsoft.public.adsi.general
Date: 2002-09-20 12:30:04 PST

<quote>
Good post.

My advice is very simple. If you are setting permissions on files within the
same domain, and you are not trying to set a large number of ACEs or setting a
large number of ACLs, then using ADsSecurity.dll is the way to go.

If you are going across domains or you have a lot of work to do, then WMI
would be your best bet.

If you want to propagate and ACL through a folders children, then WMI would be
a bit easier than ADsSecurity.dll. The easiest way to propagate permissions
on NTFS or Registry keys is to use the SetNamedSecurityInfo API, it will
automatically propagate the ACEs.

If you are running the code from XP, look closely at IADsSecurityUtility, this
object will do a number of things for you. It will properly order the ACL,
push inheritance down the folder food chain and will return you an
IADsSecurityDescriptor object, much easier to work with than trying to learn
the cryptic WMI bind syntax.

Sincerely,
Max Vaughn [MS]
Microsoft Developer Support

</quote> 

--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: http://www.microsoft.com/technet/scriptcenter

Relevant Pages

  • Re: Creating a Restore Disk Image
    ... a preference file or a secret file somewhere, ... I merely decompressed and ran the installer for ... download pages still list many of them as shareware and freeware, ... These remaining problems may indicate permissions problems (have you ...
    (comp.sys.mac.system)
  • Re: 0x80240020 - another request for help
    ... > I am trying to download the August 9 updates but get the dreaded 0x80240020 ... Verify that the following users are listed in the access permissions, ... Adminitrator ... Computer" is unchecked "Default authentication Level" is Connect ...
    (microsoft.public.windowsupdate)
  • Re: Group Policy Software Installation
    ... Did you download the correct version (with respect to language)? ... EVERYBODY / Full Control share permissions and make it something like ... The .msi is located on a share with Everyone-full control ...
    (microsoft.public.windows.server.active_directory)
  • Re: 0x80240020 - another request for help
    ... >> I am trying to download the August 9 updates but get the dreaded ... Verify that the following users are listed in the access permissions, ...
    (microsoft.public.windowsupdate)