@ -1,6 +1,6 @@
------
status: currentstatus: current
last-verified: 2026-10-06 last-verified: 2026-10-07
owner: active-agentowner: active-agent
source: current task evidencesource: current task evidence
------
@ -9,47 +9,50 @@ source: current task evidence
## Current focus## Current focus
Live tests of 5.0.0-rc4 in a lab, which the maintainer decided on5.0.0-rc5, prepared on the branch `ai/release-5.0.0-rc5` : the live tests
2026-10-06 to run before 5.0.0. He continues on another workstation thatin `Tests\Lab` (Decision 20) and the fix of
has his lab script. 5.0.0 waits for these results and for the tester`Get-NTFSEffectiveAccess -ServerName` that they found. The maintainer
feedback in #34 ; then the repository is archived in favor ofpushes the branch, opens and merges the pull request, and tags
WindowsAccessControl (Decision 18).`5.0.0-rc5` ; CI publishes it (Decision 12). Then, with the tester feedback
in #34 , he decides on 5.0.0. After 5.0.0 the repository is archived in
favor of WindowsAccessControl (Decision 18).
## Evidence## Evidence
- 2026-10-06: 5.0.0-rc4 is published from the tag `5.0.0-rc4` on- 2026-10-07: the live tests ran in the lab of WindowsAccessControl
`01d9264` , the merge commit of #113 , and verified from the Gallery (`F1ADC1`, `F1AFile2` , `F1AFile1` in `a.forest1.net` ) against the Gallery
package in both editions; its issues are closed (progress). packages of 5.0.0-rc2 and 5.0.0-rc4 and against the branch build, in
- The Pester tests run only on standalone machines against local NTFS Windows PowerShell 5.1 and PowerShell 7, with the same results in both:
folders, with local and well-known accounts. No test uses a UNC path, a - Case 1 (#34 over SMB): rc2 fails `Add-NTFSAccess` , `Clear-NTFSAccess` ,
share, a domain account, or `Get-NTFSEffectiveAccess -ServerName` , which and `Set-NTFSSecurityDescriptor` with error 1307, on folders with and
calls `AuthzInitializeRemoteResourceManager` over RPC. 5.0.0 changed no without the auto-inherit flag; the other four cmdlets succeed in rc2
code that is specific to domains or SMB. too. rc4 passes all seven and keeps Administrators as the owner.
- In #34 , the tester wrote on 2026-10-06 that the owner problem also exists - Case 2: the administrators of the file server read, add, and remove
on their IBM ESS system, and that he reports rc3 results against both audit entries over SMB; the delegated account gets the errors that the
their file servers on 2026-10-07. No lab reproduces IBM ESS. cmdlet pages describe, and the folders stay unchanged. Same in rc2.
- The second workstation has Hyper-V and AutomatedLab 5.61, but no - Case 3: with `-ServerName` of the file server, the result includes its
LabSources folder, ISO, or lab. local group, without a warning; without it, only the domain groups
- Hand commands to the maintainer as fenced code blocks at the end of the count. With a computer that can't be reached, rc2 and rc4 returned no
reply, and end the turn there; never put them in the question dialog, access, because error 1722 was swallowed; fixed on the branch.
which also covers a reply before it. A pull request names an issue - Case 4, long paths on the share, and #108 pass; #108 fails in rc2.
without a closing keyword unless the merge should close it (techContext). - The branch build passes every live test, and the 499 tests of `Tests`
in both editions.
- One `security-reviewer` pass approved the branch with minor findings;
the assertion of the fallback warning and the path guard of the live
tests were hardened. Deferred: the bare `catch` in
`Win32.GetEffectiveAccess` , which still swallows any other error of the
remote initialization (not reproducible: for a user who isn't an
administrator of the file server, the cmdlet writes "Access is denied");
the unchecked `AUTHZ_ACCESS_REPLY.Error` ; a fallback warning that names
the server and the error, which would change behavior (Decision 16).
- #34: no report from the tester by 16:00 UTC on 2026-10-07; he announced
results against two file servers, one of them IBM ESS, for that day.
- The lab keeps the accounts, the share, and the folders of the last run;
`Invoke-NTFSSecurityLabTest.ps1 -RemoveFixture` removes them.
## Next step## Next step
Build the lab with the maintainer's script: a domain controller, a fileThe maintainer runs the push and pull request commands of the session of
server with a share, and a client. From the client, run live tests against2026-10-07, merges, and tags `5.0.0-rc5` . Then check the published package
5.0.0-rc2 as the baseline and 5.0.0-rc4, in Windows PowerShell 5.1 andwith `Invoke-NTFSSecurityLabTest.ps1 -Version 5.0.0-rc5` , wait for the #34
PowerShell 7:feedback, and release 5.0.0 as `progress.md` describes.
1. #34 over SMB: a domain user who isn't an admin on the file server, with
Full Control on a share folder owned by Administrators, runs the access
and inheritance cmdlets on its UNC path. rc2 should fail with (1307);
rc4 should succeed and keep the owner.
2. The audit cmdlets over SMB, where the file server, not the client,
checks the Security privilege: as a user with and without it there.
3. `Get-NTFSEffectiveAccess` for domain accounts with nested groups, and
with `-ServerName` .
4. `Get-NTFSOrphanedAccess` with the entry of a deleted domain account.
Then, with the #34 feedback, release 5.0.0 as `progress.md` describes.
Raimund Andree
4 days ago