feat(access): name the computer in the warning of Get-NTFSEffectiveAccess

When the computer of -ServerName can't be reached, the cmdlet calculates
the result with the group memberships known on this computer and warns.
The warning now names that computer, which a command with many items
couldn't tell otherwise. The live test expects the new text as well.

Decision 22, item 5: an assumption in autopilot, flagged for the
maintainer's review.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

CHANGELOG.md

@@ -77,6 +77,8 @@ The format is based on
   administrators of the named computer and the members of its group Access
   Control Assistance Operators; any other account gets the error "Access is
   denied" and no result
+- Name the computer in the warning of `Get-NTFSEffectiveAccess` when the
+  computer of `-ServerName` can't be reached
 
 ### Deprecated
 

Docs/Cmdlets/Get-NTFSEffectiveAccess.md

@@ -31,7 +31,7 @@ Calculates the rights an account really has on a file or a folder and writes the
 
 The calculation covers the NTFS permissions of the item only. Share permissions are stored in a separate security descriptor and are not part of the result, so access over a network share can be more restrictive than this cmdlet reports.
 
-When `-Account` is omitted, the account that runs the session is used. `-ServerName` selects the computer whose authorization manager resolves the group memberships of the account and defaults to `localhost`; when the remote authorization manager of the named computer cannot be reached, the cmdlet falls back to the local one and warns that the result is based on the group memberships known on this computer and may be inaccurate. The authorization manager of the named computer answers only the administrators of that computer and the members of its local group Access Control Assistance Operators; for any other account, the cmdlet writes an error and doesn't fall back. Reading effective access relies on the Security privilege, and the cmdlet warns when the account does not hold it or the privilege is disabled.
+When `-Account` is omitted, the account that runs the session is used. `-ServerName` selects the computer whose authorization manager resolves the group memberships of the account and defaults to `localhost`; when the remote authorization manager of the named computer cannot be reached, the cmdlet falls back to the local one and warns that the result is based on the group memberships known on this computer and may be inaccurate. The warning names the computer that couldn't be reached. The authorization manager of the named computer answers only the administrators of that computer and the members of its local group Access Control Assistance Operators; for any other account, the cmdlet writes an error and doesn't fall back. Reading effective access relies on the Security privilege, and the cmdlet warns when the account does not hold it or the privilege is disabled.
 
 When `-Path` is omitted, the cmdlet calculates the effective access to the current location. In the `SecurityDescriptor` parameter set, it calculates the effective access from a `Security2.FileSystemSecurity2` object that `Get-NTFSSecurityDescriptor` returned, without reading the item again.
 
@@ -184,6 +184,8 @@ Reading effective access needs the Security privilege. In a session that does no
 
 Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`. When the computer of `-ServerName` couldn't be reached, the cmdlet warned that it had calculated the result on this computer, but returned no access instead of that result.
 
+Before 5.0.0-rc7, the warning about a computer that couldn't be reached didn't name the computer.
+
 ## RELATED LINKS
 
 [Get-NTFSAccess](Get-NTFSAccess.md)

NTFSSecurity/AccessCmdlets/GetEffectiveAccess.cs

@@ -159,9 +159,10 @@ namespace NTFSSecurity
         {
             if (!result.FromRemote)
             {
-                WriteWarning("The effective rights can only be computed based on group membership on this" +
+                // Since 5.0.0-rc7, the warning names the computer, which a command with many items can't tell otherwise.
-                              " computer. For more accurate results, calculate effective access rights on " +
+                WriteWarning(string.Format("The effective rights can only be computed based on group membership on this computer, " +
-                              "the target computer");
+                    "because the computer '{0}' can't be reached for a remote access check. " +
+                    "For more accurate results, calculate effective access rights on that computer.", serverName));
             }
 
             if (result.OperationFailed)

NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml

@@ -4945,7 +4945,7 @@ PS C:\&gt; Get-NTFSAudit -SecurityDescriptor $sd</dev:code>
     <maml:description>
       <maml:para>Calculates the rights an account really has on a file or a folder and writes the result as a single `Security2.FileSystemAccessRule2` object per item. The cmdlet evaluates the complete discretionary access control list (DACL) of the item against the group memberships of the account with the Windows Authorization API, so allow entries, deny entries, and inherited entries are combined the same way the Windows access check combines them. This is the equivalent of the "Effective Access" tab of the advanced security dialog.</maml:para>
       <maml:para>The calculation covers the NTFS permissions of the item only. Share permissions are stored in a separate security descriptor and are not part of the result, so access over a network share can be more restrictive than this cmdlet reports.</maml:para>
-      <maml:para>When `-Account` is omitted, the account that runs the session is used. `-ServerName` selects the computer whose authorization manager resolves the group memberships of the account and defaults to `localhost`; when the remote authorization manager of the named computer cannot be reached, the cmdlet falls back to the local one and warns that the result is based on the group memberships known on this computer and may be inaccurate. The authorization manager of the named computer answers only the administrators of that computer and the members of its local group Access Control Assistance Operators; for any other account, the cmdlet writes an error and doesn't fall back. Reading effective access relies on the Security privilege, and the cmdlet warns when the account does not hold it or the privilege is disabled.</maml:para>
+      <maml:para>When `-Account` is omitted, the account that runs the session is used. `-ServerName` selects the computer whose authorization manager resolves the group memberships of the account and defaults to `localhost`; when the remote authorization manager of the named computer cannot be reached, the cmdlet falls back to the local one and warns that the result is based on the group memberships known on this computer and may be inaccurate. The warning names the computer that couldn't be reached. The authorization manager of the named computer answers only the administrators of that computer and the members of its local group Access Control Assistance Operators; for any other account, the cmdlet writes an error and doesn't fall back. Reading effective access relies on the Security privilege, and the cmdlet warns when the account does not hold it or the privilege is disabled.</maml:para>
       <maml:para>When `-Path` is omitted, the cmdlet calculates the effective access to the current location. In the `SecurityDescriptor` parameter set, it calculates the effective access from a `Security2.FileSystemSecurity2` object that `Get-NTFSSecurityDescriptor` returned, without reading the item again.</maml:para>
     </maml:description>
     <command:syntax>
@@ -5155,6 +5155,7 @@ PS C:\&gt; Get-NTFSAudit -SecurityDescriptor $sd</dev:code>
         <maml:para>When the module setting `EnablePrivileges` is `$true` (the default in the `PrivateData` section of NTFSSecurity.psd1), this cmdlet tries to enable the Backup, Restore, Take Ownership, and Security privileges while it runs and disables the privileges it enabled when it finishes. These privileges are only available in an elevated session of an account that holds them, such as a member of the local Administrators group. If a privilege cannot be enabled, the cmdlet continues without it and writes a debug message.</maml:para>
         <maml:para>Reading effective access needs the Security privilege. In a session that does not hold it, the cmdlet warns before it starts and the calculation may fail with an error. Use `Enable-Privileges` in an elevated session to enable the privilege, and `Get-Privileges` to see which privileges the session holds. When the calculation fails, the error names the cause that Windows reported, such as a security descriptor without an owner; before 5.0.0, it blamed a missing Security privilege whenever the privilege wasn't enabled.</maml:para>
         <maml:para>Before 5.0.0, `-ExcludeNoneAccessEntries` had no effect, and the cmdlet returned nothing without `-Path` or for `-SecurityDescriptor`. When the computer of `-ServerName` couldn't be reached, the cmdlet warned that it had calculated the result on this computer, but returned no access instead of that result.</maml:para>
+        <maml:para>Before 5.0.0-rc7, the warning about a computer that couldn't be reached didn't name the computer.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>

Tests/Access.Tests.ps1

@@ -145,8 +145,10 @@ Describe 'Get-NTFSEffectiveAccess' {
             $accessErrors | Should -BeNullOrEmpty
             $result | Should -HaveCount 1
             $result[0].AccessRights | Should -Be $expected.AccessRights
-            $accessWarnings.Message | Should -Contain ('The effective rights can only be computed based on group membership on this computer. ' +
+            # Before 5.0.0-rc7, the warning didn't name the computer.
-                'For more accurate results, calculate effective access rights on the target computer')
+            $accessWarnings.Message | Should -Contain ("The effective rights can only be computed based on group membership on this computer, " +
+                "because the computer 'ntfssecurity-test.invalid' can't be reached for a remote access check. " +
+                'For more accurate results, calculate effective access rights on that computer.')
         }
     }
 }

Tests/Lab/NTFSSecurity.Live.Tests.ps1

@@ -408,13 +408,14 @@ Describe 'Get-NTFSEffectiveAccess for a domain account on a share folder' -Tag '
     }
 
     # The cmdlet page: when the remote authorization manager can't be reached, the cmdlet falls back to the local one
-    # and warns that the result may be inaccurate.
+    # and warns that the result may be inaccurate; since 5.0.0-rc7, the warning names the computer.
     It 'Should fall back to the authorization manager of the client and warn when -ServerName can''t be reached' {
         $result = @(Get-NTFSEffectiveAccess -Path $path -Account $subject -ServerName $configuration.UnreachableServerName -WarningVariable operationWarnings -WarningAction SilentlyContinue -ErrorVariable operationErrors -ErrorAction SilentlyContinue)
 
         Format-LabError -ErrorRecord $operationErrors | Should -BeNullOrEmpty
-        $operationWarnings.Message | Should -Contain ('The effective rights can only be computed based on group membership on this computer. ' +
+        $operationWarnings.Message | Should -Contain ('The effective rights can only be computed based on group membership on this computer, ' +
-            'For more accurate results, calculate effective access rights on the target computer')
+            "because the computer '$($configuration.UnreachableServerName)' can't be reached for a remote access check. " +
+            'For more accurate results, calculate effective access rights on that computer.')
         $result | Should -HaveCount 1
         Format-LabRight -Right $result[0].AccessRights | Should -Be (Format-LabRight -Right $configuration.EffectiveAccess.ClientRights)
     }