diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ede830..e42f0cf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -77,6 +77,8 @@ The format is based on administrators of the named computer and the members of its group Access Control Assistance Operators; any other account gets the error "Access is denied" and no result +- Name the computer in the warning of `Get-NTFSEffectiveAccess` when the + computer of `-ServerName` can't be reached ### Deprecated diff --git a/Docs/Cmdlets/Get-NTFSEffectiveAccess.md b/Docs/Cmdlets/Get-NTFSEffectiveAccess.md index c90652c..35c55ee 100644 --- a/Docs/Cmdlets/Get-NTFSEffectiveAccess.md +++ b/Docs/Cmdlets/Get-NTFSEffectiveAccess.md @@ -31,7 +31,7 @@ Calculates the rights an account really has on a file or a folder and writes the The calculation covers the NTFS permissions of the item only. Share permissions are stored in a separate security descriptor and are not part of the result, so access over a network share can be more restrictive than this cmdlet reports. -When `-Account` is omitted, the account that runs the session is used. `-ServerName` selects the computer whose authorization manager resolves the group memberships of the account and defaults to `localhost`; when the remote authorization manager of the named computer cannot be reached, the cmdlet falls back to the local one and warns that the result is based on the group memberships known on this computer and may be inaccurate. The authorization manager of the named computer answers only the administrators of that computer and the members of its local group Access Control Assistance Operators; for any other account, the cmdlet writes an error and doesn't fall back. Reading effective access relies on the Security privilege, and the cmdlet warns when the account does not hold it or the privilege is disabled. +When `-Account` is omitted, the account that runs the session is used. `-ServerName` selects the computer whose authorization manager resolves the group memberships of the account and defaults to `localhost`; when the remote authorization manager of the named computer cannot be reached, the cmdlet falls back to the local one and warns that the result is based on the group memberships known on this computer and may be inaccurate. The warning names the computer that couldn't be reached. The authorization manager of the named computer answers only the administrators of that computer and the members of its local group Access Control Assistance Operators; for any other account, the cmdlet writes an error and doesn't fall back. Reading effective access relies on the Security privilege, and the cmdlet warns when the account does not hold it or the privilege is disabled. When `-Path` is omitted, the cmdlet calculates the effective access to the current location. In the `SecurityDescriptor` parameter set, it calculates the effective access from a `Security2.FileSystemSecurity2` object that `Get-NTFSSecurityDescriptor` returned, without reading the item again. @@ -184,6 +184,8 @@ Reading effective access needs the Security privilege. In a session that does no Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`. When the computer of `-ServerName` couldn't be reached, the cmdlet warned that it had calculated the result on this computer, but returned no access instead of that result. +Before 5.0.0-rc7, the warning about a computer that couldn't be reached didn't name the computer. + ## RELATED LINKS [Get-NTFSAccess](Get-NTFSAccess.md) diff --git a/NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs b/NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs index 5284330..c8468af 100644 --- a/NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs +++ b/NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs @@ -159,9 +159,10 @@ namespace NTFSSecurity { if (!result.FromRemote) { - WriteWarning("The effective rights can only be computed based on group membership on this" + - " computer. For more accurate results, calculate effective access rights on " + - "the target computer"); + // Since 5.0.0-rc7, the warning names the computer, which a command with many items can't tell otherwise. + WriteWarning(string.Format("The effective rights can only be computed based on group membership on this computer, " + + "because the computer '{0}' can't be reached for a remote access check. " + + "For more accurate results, calculate effective access rights on that computer.", serverName)); } if (result.OperationFailed) diff --git a/NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml b/NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml index dac9bea..739c502 100644 --- a/NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml +++ b/NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml @@ -4945,7 +4945,7 @@ PS C:\> Get-NTFSAudit -SecurityDescriptor $sd Calculates the rights an account really has on a file or a folder and writes the result as a single `Security2.FileSystemAccessRule2` object per item. The cmdlet evaluates the complete discretionary access control list (DACL) of the item against the group memberships of the account with the Windows Authorization API, so allow entries, deny entries, and inherited entries are combined the same way the Windows access check combines them. This is the equivalent of the "Effective Access" tab of the advanced security dialog. The calculation covers the NTFS permissions of the item only. Share permissions are stored in a separate security descriptor and are not part of the result, so access over a network share can be more restrictive than this cmdlet reports. - When `-Account` is omitted, the account that runs the session is used. `-ServerName` selects the computer whose authorization manager resolves the group memberships of the account and defaults to `localhost`; when the remote authorization manager of the named computer cannot be reached, the cmdlet falls back to the local one and warns that the result is based on the group memberships known on this computer and may be inaccurate. The authorization manager of the named computer answers only the administrators of that computer and the members of its local group Access Control Assistance Operators; for any other account, the cmdlet writes an error and doesn't fall back. Reading effective access relies on the Security privilege, and the cmdlet warns when the account does not hold it or the privilege is disabled. + When `-Account` is omitted, the account that runs the session is used. `-ServerName` selects the computer whose authorization manager resolves the group memberships of the account and defaults to `localhost`; when the remote authorization manager of the named computer cannot be reached, the cmdlet falls back to the local one and warns that the result is based on the group memberships known on this computer and may be inaccurate. The warning names the computer that couldn't be reached. The authorization manager of the named computer answers only the administrators of that computer and the members of its local group Access Control Assistance Operators; for any other account, the cmdlet writes an error and doesn't fall back. Reading effective access relies on the Security privilege, and the cmdlet warns when the account does not hold it or the privilege is disabled. When `-Path` is omitted, the cmdlet calculates the effective access to the current location. In the `SecurityDescriptor` parameter set, it calculates the effective access from a `Security2.FileSystemSecurity2` object that `Get-NTFSSecurityDescriptor` returned, without reading the item again. @@ -5155,6 +5155,7 @@ PS C:\> Get-NTFSAudit -SecurityDescriptor $sd When the module setting `EnablePrivileges` is `$true` (the default in the `PrivateData` section of NTFSSecurity.psd1), this cmdlet tries to enable the Backup, Restore, Take Ownership, and Security privileges while it runs and disables the privileges it enabled when it finishes. These privileges are only available in an elevated session of an account that holds them, such as a member of the local Administrators group. If a privilege cannot be enabled, the cmdlet continues without it and writes a debug message. Reading effective access needs the Security privilege. In a session that does not hold it, the cmdlet warns before it starts and the calculation may fail with an error. Use `Enable-Privileges` in an elevated session to enable the privilege, and `Get-Privileges` to see which privileges the session holds. When the calculation fails, the error names the cause that Windows reported, such as a security descriptor without an owner; before 5.0.0, it blamed a missing Security privilege whenever the privilege wasn't enabled. Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`. When the computer of `-ServerName` couldn't be reached, the cmdlet warned that it had calculated the result on this computer, but returned no access instead of that result. + Before 5.0.0-rc7, the warning about a computer that couldn't be reached didn't name the computer. diff --git a/Tests/Access.Tests.ps1 b/Tests/Access.Tests.ps1 index 56b0be8..f92bea4 100644 --- a/Tests/Access.Tests.ps1 +++ b/Tests/Access.Tests.ps1 @@ -145,8 +145,10 @@ Describe 'Get-NTFSEffectiveAccess' { $accessErrors | Should -BeNullOrEmpty $result | Should -HaveCount 1 $result[0].AccessRights | Should -Be $expected.AccessRights - $accessWarnings.Message | Should -Contain ('The effective rights can only be computed based on group membership on this computer. ' + - 'For more accurate results, calculate effective access rights on the target computer') + # Before 5.0.0-rc7, the warning didn't name the computer. + $accessWarnings.Message | Should -Contain ("The effective rights can only be computed based on group membership on this computer, " + + "because the computer 'ntfssecurity-test.invalid' can't be reached for a remote access check. " + + 'For more accurate results, calculate effective access rights on that computer.') } } } diff --git a/Tests/Lab/NTFSSecurity.Live.Tests.ps1 b/Tests/Lab/NTFSSecurity.Live.Tests.ps1 index e8eae11..5459f9f 100644 --- a/Tests/Lab/NTFSSecurity.Live.Tests.ps1 +++ b/Tests/Lab/NTFSSecurity.Live.Tests.ps1 @@ -408,13 +408,14 @@ Describe 'Get-NTFSEffectiveAccess for a domain account on a share folder' -Tag ' } # The cmdlet page: when the remote authorization manager can't be reached, the cmdlet falls back to the local one - # and warns that the result may be inaccurate. + # and warns that the result may be inaccurate; since 5.0.0-rc7, the warning names the computer. It 'Should fall back to the authorization manager of the client and warn when -ServerName can''t be reached' { $result = @(Get-NTFSEffectiveAccess -Path $path -Account $subject -ServerName $configuration.UnreachableServerName -WarningVariable operationWarnings -WarningAction SilentlyContinue -ErrorVariable operationErrors -ErrorAction SilentlyContinue) Format-LabError -ErrorRecord $operationErrors | Should -BeNullOrEmpty - $operationWarnings.Message | Should -Contain ('The effective rights can only be computed based on group membership on this computer. ' + - 'For more accurate results, calculate effective access rights on the target computer') + $operationWarnings.Message | Should -Contain ('The effective rights can only be computed based on group membership on this computer, ' + + "because the computer '$($configuration.UnreachableServerName)' can't be reached for a remote access check. " + + 'For more accurate results, calculate effective access rights on that computer.') $result | Should -HaveCount 1 Format-LabRight -Right $result[0].AccessRights | Should -Be (Format-LabRight -Right $configuration.EffectiveAccess.ClientRights) }