fix: fall back to this computer when -ServerName is unreachable

Get-NTFSEffectiveAccess -ServerName with a computer that can't be
resolved or reached returned no access, while it warned that it had
calculated the result on this computer. In that case,
AuthzInitializeRemoteResourceManager fails with RPC_S_SERVER_UNAVAILABLE
(1722); the code fell back to the local authorization manager only for
EPT_S_NOT_REGISTERED (1753), and GetEffectiveAccess swallowed the
exception. It now falls back for 1722 as well, as the cmdlet page
describes. The live tests in a lab found it; the new test in
Access.Tests.ps1 reproduces it on any computer.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

CHANGELOG.md

@@ -266,5 +266,8 @@ The format is based on
   of `Get-FileHash2`, which named the AlphaFS `FileInfo` instead of the type
   name of its objects
   ([#111](https://github.com/raandree/NTFSSecurity/issues/111))
+- Fix `Get-NTFSEffectiveAccess`, which returned no access when the computer
+  of `-ServerName` couldn't be reached, although it warned that it had
+  calculated the result on this computer; it now returns that result
 
 [Unreleased]: https://github.com/raandree/NTFSSecurity/compare/4.2.6...HEAD

Docs/Cmdlets/Get-NTFSEffectiveAccess.md

@@ -182,7 +182,7 @@ When the module setting `EnablePrivileges` is `$true` (the default in the `Priva
 
 Reading effective access needs the Security privilege. In a session that does not hold it, the cmdlet warns before it starts and the calculation may fail with an error. Use `Enable-Privileges` in an elevated session to enable the privilege, and `Get-Privileges` to see which privileges the session holds. When the calculation fails, the error names the cause that Windows reported, such as a security descriptor without an owner; before 5.0.0, it blamed a missing Security privilege whenever the privilege wasn't enabled.
 
-Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`.
+Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`. When the computer of `-ServerName` couldn't be reached, the cmdlet warned that it had calculated the result on this computer, but returned no access instead of that result.
 
 ## RELATED LINKS
 

NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml

@@ -5152,7 +5152,7 @@ PS C:\&gt; Get-NTFSAudit -SecurityDescriptor $sd</dev:code>
       <maml:alert>
         <maml:para>When the module setting `EnablePrivileges` is `$true` (the default in the `PrivateData` section of NTFSSecurity.psd1), this cmdlet tries to enable the Backup, Restore, Take Ownership, and Security privileges while it runs and disables the privileges it enabled when it finishes. These privileges are only available in an elevated session of an account that holds them, such as a member of the local Administrators group. If a privilege cannot be enabled, the cmdlet continues without it and writes a debug message.</maml:para>
         <maml:para>Reading effective access needs the Security privilege. In a session that does not hold it, the cmdlet warns before it starts and the calculation may fail with an error. Use `Enable-Privileges` in an elevated session to enable the privilege, and `Get-Privileges` to see which privileges the session holds. When the calculation fails, the error names the cause that Windows reported, such as a security descriptor without an owner; before 5.0.0, it blamed a missing Security privilege whenever the privilege wasn't enabled.</maml:para>
-        <maml:para>Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`.</maml:para>
+        <maml:para>Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`. When the computer of `-ServerName` couldn't be reached, the cmdlet warned that it had calculated the result on this computer, but returned no access instead of that result.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>

Security2/Win32/Lib.cs

@@ -173,7 +173,9 @@ namespace Security2
             {
                 int error = Marshal.GetLastWin32Error();
 
-                if (error != Win32Error.EPT_S_NOT_REGISTERED) //if not RPC server unavailable
+                // The computer can't be resolved or reached (RPC server unavailable), or it doesn't offer the remote
+                // interface (endpoint not registered); the local authorization manager calculates the result instead.
+                if (error != Win32Error.EPT_S_NOT_REGISTERED && error != Win32Error.RPC_S_SERVER_UNAVAILABLE)
                 {
                     throw new Win32Exception(error);
                 }

Tests/Access.Tests.ps1

@@ -131,6 +131,24 @@ Describe 'Get-NTFSEffectiveAccess' {
             $accessErrors[0].Exception.Message | Should -Not -BeLike '*Enable-Privileges*'
         }
     }
+
+    Context 'When the computer of -ServerName cannot be reached' {
+        # Before 5.0.0-rc5, the cmdlet returned no access when the computer couldn't be reached, although it warned that
+        # it had calculated the result on this computer. Windows reports a computer that it can't resolve or reach with
+        # the error RPC server unavailable; the name ends in .invalid, which no DNS server resolves (RFC 2606).
+        It 'Should return the result of this computer and warn' {
+            $expected = Get-NTFSEffectiveAccess -Path $effectiveFile -WarningAction SilentlyContinue -ErrorAction Stop
+            [long] $expected.AccessRights | Should -BeGreaterThan ([long] [Security2.FileSystemRights2]::Synchronize)
+
+            $result = @(Get-NTFSEffectiveAccess -Path $effectiveFile -ServerName 'ntfssecurity-test.invalid' -WarningVariable accessWarnings -WarningAction SilentlyContinue -ErrorVariable accessErrors -ErrorAction SilentlyContinue)
+
+            $accessErrors | Should -BeNullOrEmpty
+            $result | Should -HaveCount 1
+            $result[0].AccessRights | Should -Be $expected.AccessRights
+            $accessWarnings.Message | Should -Contain ('The effective rights can only be computed based on group membership on this computer. ' +
+                'For more accurate results, calculate effective access rights on the target computer')
+        }
+    }
 }
 
 Describe 'Get-NTFSOrphanedAccess' {