From 3c1974722a177a3eeeb9697a1e3dfc3e0d521c48 Mon Sep 17 00:00:00 2001 From: Raimund Andree Date: Fri, 9 Oct 2026 15:45:04 +0000 Subject: [PATCH] test: set a previous owner back that the user can assign The cases for the retry of Set-NTFSSecurityDescriptor covered a descriptor that sets the owner, an owner that did not change, and an owner that the user cannot assign without the Restore privilege. The success path was not tested: the user can set a group of its access token back as the owner, such as Administrators in an elevated session, so the cmdlet restores the owner and reports nothing. The test runs elevated only, because the filtered token of the basic user cannot assign that group. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant --- Tests/SecurityDescriptor.Tests.ps1 | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/Tests/SecurityDescriptor.Tests.ps1 b/Tests/SecurityDescriptor.Tests.ps1 index b77a470..76507fe 100644 --- a/Tests/SecurityDescriptor.Tests.ps1 +++ b/Tests/SecurityDescriptor.Tests.ps1 @@ -263,6 +263,24 @@ Describe 'Set-NTFSSecurityDescriptor' { @(Get-EveryoneRule -Path $file) | Should -HaveCount 1 (Get-Acl -LiteralPath $file).GetOwner($sidType).Value | Should -Be $currentUser } + + # The user can set a group of its access token back as the owner without the Restore privilege, such as the group + # Administrators of an elevated session, so the cmdlet restores the owner and reports nothing. + It 'Should set a previous owner back that the user can assign after the write that took ownership' -Skip:(-not $canAssignAnyOwner) { + $administrators = 'S-1-5-32-544' + $file = New-TestSandboxItem -Sandbox $sandbox -Name 'RetryRestored' + Add-TestDenyRule -Sandbox $sandbox -Path $file -Rights @{ $currentUser = 'ChangePermissions' } + Set-TestOwner -Sandbox $sandbox -Path $file -Sid $administrators + Get-RestorePrivilegeState | Should -Be 'Disabled' + $sd = Get-NTFSSecurityDescriptor -Path $file + Add-NTFSAccess -SecurityDescriptor $sd -Account 'Everyone' -AccessRights ReadData + + Set-NTFSSecurityDescriptor -SecurityDescriptor $sd -ErrorVariable setErrors -ErrorAction SilentlyContinue + + $setErrors | Should -BeNullOrEmpty + @(Get-EveryoneRule -Path $file) | Should -HaveCount 1 + (Get-Acl -LiteralPath $file).GetOwner($sidType).Value | Should -Be $administrators + } } Context 'A descriptor that cannot be written' {