mirror of https://github.com/raandree/NTFSSecurity
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
111 KiB
111 KiB
| 1 | Group | Cmdlet | ParameterSet | Default | TestInvocationsScan | LiveInvocationsScan | AmbiguousInvocationsThatMayBindIt | BoundBy | StateAssertion | ErrorAssertion | PipelineInput | Continuation | OutputAssertion | KeyTests | LiveEvidence | Gap | GapKind | Evidence | StatusAfter | NewTests | Remaining | Reason |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2 | access | Add-NTFSAccess | PathComplex | True | 33 | 6 | 1 | 36 | Yes | Yes | No | Partly | Yes | Access.Tests.ps1:740 Should write an AddAceError for each item, change nothing, and return nothing with -PassThru | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:807 Should write all entries of the item after the change | PathErrors.Tests.ps1:230 Add-NTFSAccess should take ownership, add the entry, and set the owner back | 6: SMB share as delegated and domain accounts - add keeps the owner (#34), add by foreign-domain account name, deny-entry fixtures (Live:253, 877, 927, 987, 1038, 1280) | No test pipes anything into the set (FileInfo/DirectoryInfo, or objects with Account/AccessRights properties), and none combines -PassThru with one failing and one succeeding path: continuation (PathErrors:178, no -PassThru) and no output after a failure (Access:740, all items fail) are asserted in separate tests. Several -Account values, a Deny entry written through -Path (type, no Synchronize) and positional binding are untested. | TestNeeded | Access.Tests.ps1:740-751 asserts ErrorId, category WriteError, TargetObject, ArgumentException, no output and unchanged SDDL for two failing paths; PathErrors.Tests.ps1:178-192 asserts one error with the blocked target, its SDDL unchanged and the next item's entry added; Access.Tests.ps1:807-815 asserts type, entry count and the added entry of -PassThru. BoundBy = scan 33 + PathErrors:108 and :178 (& $Command) + PermissionScopes:86 (splat, Form=Flags, Source=Path); about 14 of the 36 calls are the subject of an assertion, the rest are fixtures. | Partly | ParameterSets.Access.Tests.ps1:61,62 Should add one explicit entry for each path bound through the pipeline, by FullName and by property name, leaving the rest of each item unchanged | ParameterSets.Access.Tests.ps1:91 Should write one AddAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changed | several -Account values in one call; a Deny entry written through -Path checked for AccessControlType=Deny and no auto-added Synchronize; positional binding (Add-NTFSAccess $path $account $rights) | budget (all three; proposal 1c was traded for the pipeline and PassThru-combined tests) |
| 3 | access | Add-NTFSAccess | PathSimple | False | 6 | 1 | 2 | 8 | Partly | No | No | No | Yes | PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account | PermissionScopes.Tests.ps1:110 Should apply <Name> only to its intended descendants, including the OneLevel boundary | Access.Tests.ps1:1035 Should name the folder of an inheritable entry, also with -ExcludeExplicit | ObjectApis.Tests.ps1:747 Should name the item of a descriptor and write it to a folder by its path | 1: SMB share - Deny ReadPermissions entry with -AppliesTo ThisFolderOnly as a fixture of the unknown-parent case (Live:1039); no assertion on the set itself | No test makes the set fail (missing path, denied write, deny entry without rights), pipes into it, or reads its result back with .NET: every read-back goes through -PassThru or Get-NTFSAccess. -AccessType Deny with -AppliesTo and the exclusion of -AppliesTo with -InheritanceFlags are untested. | TestNeeded | PermissionScopes.Tests.ps1:86-94 asserts type, flags, rights and ConvertToApplyTo of the -PassThru entry for 13 scopes (Form=AppliesTo, Source=Path) and :110-133 asserts which descendants inherit it, both read through the module's own cmdlets. Access.Tests.ps1:1035, Inheritance.Tests.ps1:326/365/474 and ObjectApis.Tests.ps1:747 use the set as a fixture. BoundBy = scan 6 + the splats PermissionScopes:84 and :86 (Source=Path); 2 of the 8 calls are the subject of an assertion. | Partly | ParameterSets.Access.Tests.ps1:113,129 Should report a missing path's error by category and target, still scope the next path's entry, and keep binding -Path through the pipeline once -AppliesTo selects the set | ParameterSets.Access.Tests.ps1:572 Should require -AppliesTo only in the Simple parameter sets, -InheritanceFlags/-PropagationFlags only in the Complex parameter sets, and reject combining -AppliesTo with -InheritanceFlags without changing the item | a denied write for this set; a Deny entry without rights (-AccessType Deny -AccessRights None) for this set; -AccessType Deny combined with -AppliesTo | budget (all three; the write-denial code path is shared with PathComplex and already covered there) |
| 4 | access | Add-NTFSAccess | SDSimple | False | 2 | 0 | 2 | 4 | Partly | No | No | No | Yes | Access.Tests.ps1:898 Add-NTFSAccess should still take -AppliesTo for a security descriptor | PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account | SecurityDescriptor.Tests.ps1:355 Should write the descriptor and report a read error for -PassThru, not a write error | 0 | Only InheritanceFlags for ThisFolderOnly is read back from the descriptor with .NET (Access:898); the 13 scopes are checked through the cmdlet's own -PassThru, and no test pipes descriptors in or passes several. A failing change (for example a deny entry without rights) ends the cmdlet with a terminating error and no test pins it (open item 1). | MaintainerDecision | Access.Tests.ps1:898-902 reads the rule from $sd.SecurityDescriptor with .NET; PermissionScopes.Tests.ps1:86-97 asserts type, flags, rights and, for Source=SecurityDescriptor, that the SDDL on disk is unchanged (13 cases). BoundBy = scan 2 (Access:898; SecurityDescriptor:355 is a fixture) + the splats PermissionScopes:84 and :86 (Source=SecurityDescriptor, Form=AppliesTo). | MaintainerDecision | all 13 scopes read back with .NET for Source=SecurityDescriptor (only ThisFolderOnly already was, pre-existing); piped descriptors; several descriptors; the failing-change (deny entry without rights) terminating error, not pinned | budget (the 13-scope/pipe/several items, notes proposal (b2)#1 not implemented); MaintainerDecision (the failing-change open item) | |
| 5 | access | Add-NTFSAccess | SDComplex | False | 14 | 2 | 1 | 16 | Yes | No | No | No | Yes | Access.Tests.ps1:822 Should write all entries of a security descriptor after the change and leave the item unchanged | Access.Tests.ps1:887 Add-NTFSAccess should apply the entry to the folder, its subfolders, and files by default | SecurityDescriptor.Tests.ps1:81 Should write the entry as the only explicit entry of the item | PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 2: SMB share - descriptor written back keeps the owner (#34, Live:316) and the fixture of the later-command cases (Live:1151) | No test pipes descriptors into the cmdlet, and arrays of descriptors appear only as fixtures of Set-NTFSSecurityDescriptor (SecurityDescriptor.Tests.ps1:306, :324; PipelineControl.Tests.ps1:211). A failing descriptor (deny entry without rights) ends the cmdlet with a terminating error and no test pins it (open item 1). | MaintainerDecision | Access.Tests.ps1:822-827 asserts that -PassThru writes as many entries as $sd.SecurityDescriptor holds, one new explicit entry, and no Everyone entry on disk; :887-892 reads the default flags back with .NET; SecurityDescriptor.Tests.ps1:81-86 asserts exactly one explicit entry on disk after Set-NTFSSecurityDescriptor. BoundBy = scan 14 + Access:872 (& $_, asserts only no throw) + PermissionScopes:86 (splat); 5 of the 16 calls are the subject of an assertion. | MaintainerDecision | piped descriptors into the cmdlet; arrays of descriptors used only as Set-NTFSSecurityDescriptor fixtures, not asserted for Add itself; the failing descriptor (deny entry without rights) terminating error, not pinned | budget (the pipe/array items, notes proposal (b2)#2 not implemented); MaintainerDecision (the failing-descriptor open item) | |
| 6 | access | Remove-NTFSAccess | PathComplex | True | 13 | 2 | 2 | 17 | Yes | Yes | Yes | Partly | Partly | Access.Tests.ps1:539 Should write a RemoveAceError for each item, change nothing, and return nothing with -PassThru | Access.Tests.ps1:617 Should remove an inherit-only entry that Get-NTFSAccess returned, and nothing else | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:651 Should take only the requested generic right from the entry of the account when another account has an exact entry | 2: SMB share - remove keeps the owner (#34, Live:264), remove by foreign-domain account name (Live:886) | No test combines -PassThru with one failing and one succeeding path, none asserts the type or the complete entry list of the -PassThru output, and the pipeline test pipes a single entry per case. Several -Account values and positional binding are untested. | TestNeeded | Access.Tests.ps1:539-550 asserts ErrorId, category, target, ArgumentException, no output and unchanged SDDL for two paths; :616-620 pipes Get-NTFSAccess output (binding by property name) and asserts the exact SDDL minus the entry in 3 cases; PathErrors.Tests.ps1:178-192 asserts the next item's entry is removed after one error. BoundBy = scan 13 + Access:617 (pipeline, resolves to PathComplex), PathErrors:108 and :178 (& $Command), PermissionScopes:99 (splat, Form=AppliesTo, Source=Path); all 17 calls are the subject of an assertion. | Partly | ParameterSets.Access.Tests.ps1:157 Should write one RemoveAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changed | the -PassThru output's count is not checked against the complete entry list of the surviving item (only non-emptiness, type, FullName, and absence of the removed account); the pipeline test still pipes only a single entry per call; several -Account values; positional binding | budget (all four) |
| 7 | access | Remove-NTFSAccess | PathSimple | False | 0 | 0 | 2 | 1 | Partly | No | No | No | Partly | PermissionScopes.Tests.ps1:99 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 0 | Only the -RemoveSpecific form with -PassThru is bound (13 scopes, Form=Flags); removing rights without -RemoveSpecific, a Deny entry, a missing or denied path, several paths and piped input are untested for this set, and nothing reads the item back with .NET. | TestNeeded | BoundBy = 1 although the scan found 0: PermissionScopes.Tests.ps1:99 binds -AppliesTo when Form is Flags (add with flags, remove with -AppliesTo), 13 cases with Source=Path; it asserts that the account's entry is gone from the -PassThru output and the keeper stays once (:101-102) and that Get-NTFSAccess finds nothing (:103). No other test binds -AppliesTo with Remove-NTFSAccess. | Partly | ParameterSets.Access.Tests.ps1:179 Should take only the requested rights from an entry scoped by -AppliesTo without -RemoveSpecific, keep its flags, and leave another account's entry untouched | a Deny entry's rights-reduction without -RemoveSpecific; a missing or denied path for this set; several paths in one call; piped input | budget (all four; the shared path-resolution/write-denial code is already covered for PathComplex) |
| 8 | access | Remove-NTFSAccess | SDSimple | False | 0 | 0 | 2 | 1 | Partly | No | No | No | Partly | PermissionScopes.Tests.ps1:99 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 0 | Same single splat test as PathSimple with a descriptor: the removal is read back only through -PassThru and Get-NTFSAccess, the item on disk is not checked after it, and nothing tests removal without -RemoveSpecific, piped descriptors or several descriptors. A failing removal ends the cmdlet with a terminating error and no test pins it (open item 1). | MaintainerDecision | BoundBy = 1 although the scan found 0: PermissionScopes.Tests.ps1:99 binds the set for Source=SecurityDescriptor, Form=Flags (13 cases) and asserts the -PassThru output (:101-102) and Get-NTFSAccess -SecurityDescriptor (:103) after the removal; the SDDL check at :96 runs before the removal. | MaintainerDecision | removal read back only through -PassThru/Get-NTFSAccess, not the item on disk after it; removal without -RemoveSpecific; piped descriptors; several descriptors; the failing removal terminating error, not pinned | budget (the read-back/RemoveSpecific/pipe/several items, notes proposal (b2)#3 not implemented); MaintainerDecision (the failing-removal open item) | |
| 9 | access | Remove-NTFSAccess | SDComplex | False | 4 | 0 | 2 | 6 | Partly | No | No | No | Partly | Access.Tests.ps1:915 Remove-NTFSAccess should remove a deny entry from the descriptor and leave the item unchanged | Access.Tests.ps1:682 Should remove an entry that matches exactly | Access.Tests.ps1:688 Should take the rights away from a matching entry without -RemoveSpecific | Access.Tests.ps1:676 Should keep an entry that does not match exactly | 0 | No test removes an entry that exists on disk from a descriptor and checks that the item keeps it until Set-NTFSSecurityDescriptor: the entries of Access:676-688 and :915 are added in memory only, so a write-through would go unnoticed. No piped or multiple descriptors, and a failing removal ends the cmdlet with a terminating error (open item 1). | MaintainerDecision | Access.Tests.ps1:676-692 reads $sd.SecurityDescriptor with .NET for -RemoveSpecific (kept or removed) and for the rights removal; :915-920 removes an in-memory Deny entry and checks that no such entry is on disk, which also holds if both cmdlets wrote through. BoundBy = scan 4 + Access:872 (& $_, no throw only) + PermissionScopes:99 (splat, Form=AppliesTo, Source=SecurityDescriptor, -PassThru check). | MaintainerDecision | no test removes an on-disk entry from a descriptor and checks the item keeps it until Set-NTFSSecurityDescriptor (write-through check); no piped or multiple descriptors; the failing removal terminating error, not pinned | budget (the write-through/pipe/several items, notes proposal (b2)#3 not implemented); MaintainerDecision (the failing-removal open item) | |
| 10 | access | Clear-NTFSAccess | Path | True | 6 | 2 | 0 | 8 | Partly | Partly | No | Yes | NA | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:932 Should leave the item with an empty, protected DACL | PathErrors.Tests.ps1:271 Clear-NTFSAccess -DisableInheritance should take ownership, clear and protect the DACL, and not set an unchanged owner back | PathErrors.Tests.ps1:289 Clear-NTFSAccess -DisableInheritance should report RestoreOwnerError for a previous owner that it cannot set back | 2: SMB share - clear keeps the owner (#34, Live:274); -DisableInheritance as the owner takes ownership without a RestoreOwnerError (Live:957) | No test asserts that a plain Clear leaves the inherited entries and the inheritance flag untouched, or clears a folder (all unit tests use files). ClearAclError and ReadFileError are asserted by ErrorId and target without category, and nothing is piped in. | TestNeeded | PathErrors.Tests.ps1:178-192 asserts one ClearAclError for the blocked path, its SDDL unchanged and no explicit entry on the next item; Access.Tests.ps1:932-936 and PathErrors.Tests.ps1:271-277 assert a protected, empty DACL and the unchanged owner with .NET; PathErrors.Tests.ps1:289-294 asserts RestoreOwnerError with category WriteError and target (elevated only). BoundBy = scan 6 + PathErrors:108 and :178 (& $Command); 7 of the 8 calls are the subject of an assertion. | Closed | ParameterSets.Access.Tests.ps1:212 Should clear each piped folder's explicit entries, including an inherit-only one, and leave inherited entries and the owner untouched | ParameterSets.Access.Tests.ps1:237,248 Should report a missing path's ReadFileError and a blocked path's ClearAclError, each by category and target | ||
| 11 | access | Clear-NTFSAccess | SD | False | 3 | 1 | 0 | 3 | Partly | No | No | No | NA | SecurityDescriptorSets.Tests.ps1:60 Clear-NTFSAccess -DisableInheritance should leave the descriptor with an empty, protected DACL | SecurityDescriptorSets.Tests.ps1:45 Clear-NTFSAccess should remove the explicit access entries of the descriptor | SecurityDescriptor.Tests.ps1:236 Should not report an owner that did not change when the write that took ownership leaves an empty DACL | 1: SMB share - cleared descriptor written with Set-NTFSSecurityDescriptor without a RestoreOwnerError (Live:966) | No test checks that a plain Clear of a descriptor keeps its inherited entries and inheritance flag, pipes descriptors in, or passes several. The set has no per-item handler and no test makes it fail; it is not among the open items, so no test is proposed for that. | TestNeeded | SecurityDescriptorSets.Tests.ps1:45-50 asserts 0 explicit entries in the descriptor, 1 still on disk, then 0 after Set-NTFSSecurityDescriptor; :60-68 asserts a protected, empty DACL in memory, the DACL on disk unchanged and the written result; SecurityDescriptor.Tests.ps1:236-244 asserts that the owner stays after the write (the call there is a fixture of a Set-NTFSSecurityDescriptor test). BoundBy = 3 (no ambiguous calls). | Closed | ParameterSets.Access.Tests.ps1:271 Should clear each piped descriptor's explicit entries in memory, leave the items unchanged until Set-NTFSSecurityDescriptor, and keep the owner | ||
| 12 | access | Get-NTFSAccess | Path | True | 25 | 3 | 2 | 29 | NA | Partly | No | Yes | Partly | PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | PathErrors.Tests.ps1:145 <Command> should write a ReadSecurityError for it and continue with the next path | Access.Tests.ps1:55 Should return the entries of the first item once | DriveRoot.Tests.ps1:34 Get-NTFSAccess should return the access entries of the root folder | 3: SMB share - entries of a path longer than 260 characters, foreign-domain account entries, unknown-parent InheritedFrom (Live:543, 859, 1048) | No test pipes FileInfo/DirectoryInfo into the set (or passes a folder object by position, #88), asserts what it returns without -Path (Owner.Tests.ps1:98 only checks that nothing throws), or asserts the category of ReadFileError and ReadSecurityError (the latter is WriteError after a failed ownership retry, see notes). No test asserts the emitted type or the declared OutputType. | TestNeeded | PathErrors.Tests.ps1:108-115 and :145-152 assert one error with ErrorId and target and output for the next path; Access.Tests.ps1:55-59 asserts the first item's entries appear once after a failing path, but the path fails only without elevation; Access.Tests.ps1:1108-1118 asserts a NULL DACL gives one entry with Sid, IsInherited and InheritedFrom, and DriveRoot.Tests.ps1:34-36 that the SID list equals Get-Acl. BoundBy = scan 25 + PathErrors:108/:145 + Owner.Tests.ps1:98 (& $cmdlet, no throw only) + PermissionScopes:103 (splat, Source=Path). | Partly | ParameterSets.Access.Tests.ps1:303,305,315 Should return the same entries for a folder bound through the pipeline and by position, and report a missing path's error by category and target | ParameterSets.Access.Tests.ps1:548 <Name> should declare <Types> as its output type | what the cmdlet returns without -Path at all (beyond not throwing, Owner.Tests.ps1:98); the category of ReadSecurityError after a failed ownership retry; BeOfType on an actual emitted object (only the declared OutputType is asserted) | budget (the no -Path case); would-pin (ReadSecurityError is WriteError after a failed retry but OpenError from the generic catch - asserting a category here would cement that inconsistency, per the notes); budget (BeOfType on a live object) |
| 13 | access | Get-NTFSAccess | SD | False | 1 | 0 | 2 | 3 | NA | No | Partly | No | Partly | SecurityDescriptorSets.Tests.ps1:139 Get-NTFSAccess should return the entries that it returns for the path | Access.Tests.ps1:1098 Should read a security descriptor with audit entries and name the same folders | PermissionScopes.Tests.ps1:103 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 0 | No test uses -Account, -ExcludeExplicit or -ExcludeInherited with a descriptor except the empty-result check of PermissionScopes:103, so an entry added to the descriptor in memory is never shown in the output; no test passes several descriptors or pipes more than one. The set has no per-item handler and no failing descriptor is tested. | TestNeeded | SecurityDescriptorSets.Tests.ps1:139-143 pipes one descriptor and compares Sid, rights and IsInherited of every entry with the -Path result (one item; the output cannot tell the SecurityDescriptor parameter from -Path bound by FullName); Access.Tests.ps1:1098-1103 (elevated only) compares count and InheritedFrom with the path result. BoundBy = scan 1 + SecurityDescriptorSets:139 (pipeline) + PermissionScopes:103 (splat, Source=SecurityDescriptor, asserts only an empty result). | Partly | ParameterSets.Access.Tests.ps1:331,336,338,345 Should filter an entry added to a descriptor in memory by -Account, partition it with -ExcludeInherited and -ExcludeExplicit, and read two descriptors bound through the pipeline | no failing descriptor is tested for this set (no per-item handler) | Limit (the SD loop has no try/catch; an exception would be unhandled and terminating, not a graceful per-item error - the same situation as the Clear-NTFSAccess SD row, which the notes explicitly excuse and this row's Gap text does not) |
| 14 | access | Get-NTFSOrphanedAccess | Path | False | 4 | 4 | 0 | 6 | NA | Partly | No | Partly | Partly | Access.Tests.ps1:218 Should return the entries whose account cannot be resolved | Access.Tests.ps1:222 Should return only the entries of -Account | PathErrors.Tests.ps1:145 <Command> should write a ReadSecurityError for it and continue with the next path | PipelineControl.Tests.ps1:148 <Name> should stop after the first object for Select-Object -First 1 and change nothing else | 4: SMB share - entry of a deleted domain account with its SID, inherited entry and -ExcludeInherited, foreign-domain accounts not reported (Live:504, 515, 516, 868) | -ExcludeExplicit and -ExcludeInherited are untested in unit tests (lab only), and PathErrors runs this cmdlet with Output=false, so no test shows that the next path is processed after an error; no pipeline input and no category for ReadFileError or ReadSecurityError. A read failure other than access denied is written as a warning, which no test reaches. | TestNeeded | Access.Tests.ps1:218-225 asserts 2 orphaned entries and, for -Account, 1 entry with its Sid; PathErrors.Tests.ps1:108-115 and :145-152 assert one error with ErrorId and target but cannot show continuation because Output is false for this cmdlet (:29, :56). BoundBy = scan 4 + PathErrors:108 and :145 (& $Command). | Partly | ParameterSets.Access.Tests.ps1:362,363,369,370 Should mark an orphaned entry explicit on its own folder and inherited on a child, partitioned by -ExcludeInherited and -ExcludeExplicit | ParameterSets.Access.Tests.ps1:379,393 Should write a ReadFileError for a missing path, still return the orphaned entry of the next path, and accept both bound through the pipeline | the category of ReadSecurityError after a failed ownership retry; a read failure other than access denied, which is written as a warning, not an error | budget (ReadSecurityError here has one consistent category, ReadError, unlike Get-NTFSAccess, so it was safely assertable but not attempted); would-pin (the warning-not-error choice; the notes explicitly decline to propose pinning it) |
| 15 | access | Get-NTFSOrphanedAccess | SD | False | 1 | 0 | 0 | 1 | NA | No | No | No | Partly | Access.Tests.ps1:231 Should read the entries of a security descriptor | 0 | Only the count (2) and FullName are asserted; -Account, -ExcludeExplicit and -ExcludeInherited with a descriptor, the orphaned Sids, several or piped descriptors, and a descriptor changed in memory are untested. | TestNeeded | BoundBy = 1 (unambiguous; the cmdlet has no ambiguous rows): Access.Tests.ps1:231-234 asserts 2 entries, each with FullName equal to the file. Nothing else binds the set. | Partly | ParameterSets.Access.Tests.ps1:408,409,410,420 Should filter a descriptor's orphaned entries by -Account, report both orphaned Sids by default, exclude them all with -ExcludeExplicit, and read two descriptors bound through the pipeline | -ExcludeInherited with a descriptor; a descriptor changed only in memory (not written to disk) still reporting its orphaned entries | budget (both; the same fixture already built in this test could have been extended) |
| 16 | access | Get-NTFSSimpleAccess | Path | False | 20 | 1 | 2 | 21 | NA | Partly | Yes | Yes | Yes | Access.Tests.ps1:353 Should report all entries of the first folder and of the following folder only what the parent does not cover | Access.Tests.ps1:362 Should compare the folders from the pipeline in the same way | Access.Tests.ps1:485 Should write an error for a path that does not exist and continue with the next path | Access.Tests.ps1:267 Should show the entries as a table with the account, the rights, and the type | 1: SMB share - parent folder first and for the subfolder only its own entry, as the delegated account (Live:832) | The ReadError of a missing path is asserted by ErrorId only (no category or target), and no test makes a folder unreadable: unlike Get-NTFSAccess the cmdlet does not retry as the owner, so what an unreadable folder reports is unpinned. | TestNeeded | Access.Tests.ps1:353-358 and :362-364 assert all 4 entries of the parent and only the child's own entry, for -Path and for Get-Item2 objects piped in; :485-490 asserts one ReadError and that every output object belongs to the next path; :267-269 asserts the table view; :251-254 and the rights-reduction cases assert Identity.Sid and AccessRights. BoundBy = scan 20 + Access:362 (pipeline, resolves to Path). | Partly | ParameterSets.Access.Tests.ps1:448 Should report an unreadable folder's error by category and target and still report the next folder's entries | the ReadError of a missing path (as opposed to an unreadable one) is still asserted by ErrorId only, without category or target | budget (Access.Tests.ps1:485 cannot be edited under a one-new-file brief, and no equivalent new test for the missing-path precondition specifically was added) |
| 17 | access | Get-NTFSSimpleAccess | SD | False | 1 | 0 | 2 | 2 | NA | No | Partly | No | Partly | Access.Tests.ps1:476 Should report the security descriptor of a file | Access.Tests.ps1:260 Should read the entries of a security descriptor | 0 | Only non-empty output and FullName are asserted; -Account, -ExcludeExplicit, -ExcludeInherited, the reduced rights and several descriptors are untested for the descriptor set, and no failing descriptor is tested. | TestNeeded | Access.Tests.ps1:260-263 reads one descriptor; :476-479 pipes one descriptor of a file: the -Path set skips files (Access:468-473), so a non-empty result can only come from the SD set; both assert FullName only. BoundBy = scan 1 + Access:476 (pipeline, resolves to SD). | Partly | ParameterSets.Access.Tests.ps1:469,470,474,476,477,482 Should filter and partition a descriptor's entries like the equivalent -Path call, and read two descriptors bound through the pipeline | no failing descriptor is tested for this set (no per-item handler) | Limit (same no-per-item-handler situation as the Clear-NTFSAccess SD and Get-NTFSAccess SD rows) |
| 18 | access | Get-NTFSEffectiveAccess | Path | True | 11 | 7 | 1 | 15 | NA | Yes | No | Partly | Partly | Access.Tests.ps1:1140 Should report the native identity error for each <Source> and return no access entry | Access.Tests.ps1:86 Should leave out an account without access when -ExcludeNoneAccessEntries is used | Access.Tests.ps1:145 Should return the result of this computer and warn | PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | 7: SMB share, domain and delegated accounts - rights through domain groups and file-server groups with -ServerName, fallback warning, GetEffectiveAccessError for access denied (Live:419, 428, 438, 456, 478, 486, 895) | No unit test asserts the content of the rights (for example an allow and a deny entry on a file with a protected DACL: ReadData present, WriteData absent), pipes objects in, or shows in one call that a failing path emits nothing while the next path emits only its own result. The ReadEffectivePermissionError handlers cannot be reached because the library hides its failures, and remote and group-based results need the lab. | TestNeeded | Access.Tests.ps1:1140-1153 asserts for two failing paths ErrorId GetEffectiveAccessError, category ReadError, TargetObject, Win32Exception 1332, no output and unchanged SDDL; PathErrors.Tests.ps1:108-115 asserts ReadFileError and output for the next path; Access.Tests.ps1:86-95 asserts the ExcludeNone filter and :145-157 the warning text and equal rights. BoundBy = scan 11 + Access:1140 (splat, Source=Path) + PathErrors:108/:145 + Owner.Tests.ps1:98 (& $cmdlet, no throw only). | Partly | ParameterSets.Access.Tests.ps1:498 Should report an allowed right as present and a denied right as absent for a protected DACL | ParameterSets.Access.Tests.ps1:508 Should return one result per item bound through the pipeline, in order | one call combining a failing path (for example a missing one) with a succeeding one, showing the failing path emits nothing and the next emits only its own result; the ReadEffectivePermissionError handler; remote and group-based results | budget (the failing+succeeding combination); Limit (ReadEffectivePermissionError is unreachable - the library records failures instead of throwing); Limit (remote/group-based results need the lab) |
| 19 | access | Get-NTFSEffectiveAccess | SecurityDescriptor | False | 2 | 0 | 1 | 3 | NA | Yes | No | Partly | Partly | Access.Tests.ps1:1140 Should report the native identity error for each <Source> and return no access entry | Access.Tests.ps1:132 Should name the cause in the error, not the Security privilege | Access.Tests.ps1:107 Should compute the effective access of a security descriptor | 0 | No test shows that the result follows an entry added to the descriptor in memory (and not the file on disk), pipes descriptors in, or passes a mix of failing and succeeding descriptors; the rights themselves are not asserted. | TestNeeded | Access.Tests.ps1:1140-1153 (Source=SecurityDescriptor, 2 descriptors) asserts the same error triple, Win32Exception 1332 and no output; :132-137 asserts one GetEffectiveAccessError that does not blame the privilege; :107-111 asserts one result with the FullName of the file. BoundBy = scan 2 + Access:1140 (splat, Source=SecurityDescriptor). | Partly | ParameterSets.Access.Tests.ps1:524,530,539 Should follow a descriptor changed only in memory while the -Path result stays on disk, and read two descriptors bound through the pipeline | a mix of a failing and a succeeding descriptor in one call | Limit (the per-item catch exists but is unreachable in a unit sandbox; the library records the Authz failure instead of throwing, per the notes) |
| 20 | audit | Add-NTFSAudit | PathComplex | True | 27 | 4 | 1 | 30 | Yes | Yes | No | Yes | Yes | Audit.Tests.ps1:147 Should write an AddAceError for each item, change nothing, and return nothing with -PassThru | Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:178 Should add the audit entry and keep the owner | PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 4 (NTFSSecurity.Live.Tests.ps1:348, 385, 1010, 1016): SMB share with domain accounts; owner kept; the delegated account gets an AddAceError that names the missing privilege and leaves the SDDL unchanged; the file server counts the SACL entries (:1441) | No test pipes paths or objects into -Path, binds Account/AccessRights/AuditFlags by property name, or adds for several accounts. No test asserts the result of a succeeding path that follows a failing one (PathErrors.Tests.ps1:124 only counts errors), and the owner retry after access denied cannot run on a local volume (Limit). | TestNeeded | Audit.Tests.ps1:149-158 asserts AddAceError, WriteError, target, ArgumentException, no -PassThru output and an unchanged SACL (Get-Acl -Audit) for two failing paths; :631-669 and :672-679 assert ReadFileError/OpenError/target, the FullName of the output, the SACL rule, and unchanged DACL/owner SDDL. BoundBy 30 = scan 27 + PermissionScopes:146 (13 of 52 cases) + 2 calls through & $Command that the scan cannot see (Audit.Tests.ps1:629, PathErrors.Tests.ps1:124); 23 of the 27 scanned calls are fixtures. | Partly | ParameterSets.Audit.Tests.ps1:123 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged | AuditFlags not bound by property name; adding for several accounts in one call; the owner retry after access denied | budget; budget; Limit (needs a lab or a remote server) |
| 21 | audit | Add-NTFSAudit | PathSimple | False | 5 | 0 | 2 | 7 | Partly | No | No | No | Yes | PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | Inheritance.Tests.ps1:386 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged | Inheritance.Tests.ps1:424 Set-NTFSInheritance should re-enable audit inheritance on a <_> and keep its explicit audit entry | 0 | No call of this set fails on purpose, passes several paths, or pipes objects, and a conflict of -AppliesTo with -InheritanceFlags is not tested. The added entry is read back only from -PassThru and Get-NTFSAudit, and owner and DACL after the call are not asserted for this set. | TestNeeded | The only call under test is PermissionScopes.Tests.ps1:146 (Source=Path with the -AppliesTo form, 13 of 52 cases): :149-154 assert type, Inheritance/Propagation/AuditFlags and the scope name, and :161-163 that the other account remains. The other calls (PermissionScopes:144, Audit.Tests.ps1:618 and :690, Inheritance.Tests.ps1:386, :424, :503) are fixtures; BoundBy 7 = scan 5 + :144 and :146 resolved from the splat. | Closed | ParameterSets.Audit.Tests.ps1:123 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged | ParameterSets.Audit.Tests.ps1:193 Should reject -AppliesTo combined with -InheritanceFlags with an AmbiguousParameterSet error and change nothing | ||
| 22 | audit | Add-NTFSAudit | SDSimple | False | 0 | 0 | 2 | 2 | Partly | No | No | No | Yes | PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | Audit.Tests.ps1:89 Should take -Account at position 2 and -AccessRights at position 3 in the <_> parameter set | 0 | No test makes this set fail, passes or pipes several descriptors, or reads the changed descriptor with .NET; a descriptor without audit entries is tested only with the complex form. Exceptions of the change itself end the cmdlet (open item 1) and are not to be pinned. | TestNeeded | Only PermissionScopes.Tests.ps1:146 binds it (Source=SecurityDescriptor with -AppliesTo, 13 of 52 cases; the fixture at :144 in 26): :149-154 assert the -PassThru type and flags and :156 that the SACL of the item is unchanged (Get-Acl -Audit). Audit.Tests.ps1:89 checks the positions by reflection only; BoundBy 2 resolves the two splat calls, the scan found 0. | Partly | ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:154 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it | ParameterSets.Audit.Tests.ps1:208 Should add the entry to the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directly | exceptions from the change itself (open item 1) | MaintainerDecision (open item) |
| 23 | audit | Add-NTFSAudit | SDComplex | False | 5 | 0 | 1 | 8 | Yes | Partly | No | No | Yes | Audit.Tests.ps1:107 Should bind an account and access rights that are passed by position | Audit.Tests.ps1:120 Should return the audit entries of a security descriptor, not its access entries | SecurityDescriptor.Tests.ps1:120 Should write an added audit entry and keep the owner | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries | 0 | Only the ErrorId is asserted for a descriptor without audit entries, not its category (InvalidData) or target, and no test pipes descriptors or passes several (one without audit entries), so pipeline binding and continuation are untested. Exceptions of the change itself are open item 1 and are not to be pinned. | TestNeeded | Audit.Tests.ps1:109-110 reads the in-memory SACL with .NET and :122-136 assert type, Sid, InheritanceEnabled and the unchanged access protection; SecurityDescriptor.Tests.ps1:124-126 asserts after Set-NTFSSecurityDescriptor that the owner is kept and the entry exists; PermissionScopes.Tests.ps1:156 asserts the item is untouched until written. BoundBy 8 = scan 5 + PermissionScopes:146 (13 of 52 cases) + & $Command at Audit.Tests.ps1:425 and Access.Tests.ps1:881 (Should -Not -Throw only). | Partly | ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:154 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it | exceptions from the change itself (open item 1) | MaintainerDecision (open item) |
| 24 | audit | Remove-NTFSAudit | PathComplex | True | 7 | 2 | 1 | 10 | Yes | Yes | No | Yes | Yes | Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:361 Should keep an audit entry that does not match exactly, given the path | Audit.Tests.ps1:371 Should remove an audit entry that matches exactly, given the path | Audit.Tests.ps1:384 Should return the audit entries of the item, not its access entries | 2 (NTFSSecurity.Live.Tests.ps1:357, 398): SMB share with domain accounts; owner kept; the delegated account gets a RemoveAceError that names the missing privilege and leaves the SDDL unchanged; the file server counts the SACL entries (:1441) | No test pipes paths or objects in, removes for several accounts, asserts the result of a succeeding path after a failing one, or removes only some rights (without -RemoveSpecific). An item without SACL is tested for no error only (Audit.Tests.ps1:406), and the owner retry cannot run on a local volume (Limit). | TestNeeded | Audit.Tests.ps1:631-669 and :672-679 assert ReadFileError/OpenError/target (RemoveAceError/WriteError/target as a basic user), the SACL changed with no rule left, and unchanged DACL/owner SDDL; :363-365 and :373-374 read back through Get-NTFSAudit. BoundBy 10 = scan 7 + PermissionScopes:159 (13 of 52 cases) + & $Command at Audit.Tests.ps1:629 and PathErrors.Tests.ps1:124; :386-388 assert type and the other entry but pass even if nothing was removed. | Partly | ParameterSets.Audit.Tests.ps1:225 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:286 Should narrow an entry that grants more rights than it removes, instead of deleting it | removing for several accounts in one call; state (empty Audit SDDL, unchanged DACL) of an item without a SACL; the owner retry after access denied | budget; budget; Limit (needs a lab or a remote server) |
| 25 | audit | Remove-NTFSAudit | PathSimple | False | 0 | 0 | 1 | 1 | Partly | No | No | No | Partly | PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 0 | Only one data-driven call binds it: no failing item, pipeline input, several items, or owner and DACL check after the call, the objects are checked by Sid only, and it never runs without -RemoveSpecific. | TestNeeded | PermissionScopes.Tests.ps1:159 binds it only when Source=Path and Form=Flags (13 of 52 cases, always with -RemoveSpecific): :161-163 assert that the entry of the account is gone from -PassThru, that the other account remains, and that Get-NTFSAudit returns nothing for the account. BoundBy 1: the scan found 0 and this ambiguous splat call is the only one that binds the set. | Closed | ParameterSets.Audit.Tests.ps1:225 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:304 Should remove the entry from the path when -Path, -Account, -AccessRights, and -AppliesTo are all named directly | ||
| 26 | audit | Remove-NTFSAudit | SDSimple | False | 0 | 0 | 1 | 1 | Partly | No | No | No | Partly | PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 0 | Only one data-driven call binds it: the changed descriptor is read only through -PassThru and Get-NTFSAudit, the item being untouched after the removal is not asserted, and no test makes it fail, pipes or passes several descriptors, or runs without -RemoveSpecific. | TestNeeded | PermissionScopes.Tests.ps1:159 binds it only when Source=SecurityDescriptor and Form=Flags (13 of 52 cases, always with -RemoveSpecific): :161-163 assert that the entry of the account is gone, that the other account remains, and that Get-NTFSAudit returns nothing; the SACL on disk is compared only after the Add (:156). BoundBy 1: the scan found 0 and this ambiguous splat call is the only one that binds the set. | Partly | ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:256 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:321 Should remove the entry from the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directly | the item on disk being untouched after the removal, until Set-NTFSSecurityDescriptor writes it | budget |
| 27 | audit | Remove-NTFSAudit | SDComplex | False | 2 | 0 | 1 | 5 | Partly | Partly | No | No | Partly | Audit.Tests.ps1:347 Should keep an audit entry that does not match exactly | Audit.Tests.ps1:353 Should remove an audit entry that matches exactly | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries | PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 0 | The item being untouched after the removal and the result after Set-NTFSSecurityDescriptor are not asserted, the error test lacks category and target, and no test pipes or passes several descriptors, checks the -PassThru type, or asserts a removal without -RemoveSpecific. Exceptions of the change itself are open item 1 and are not to be pinned. | TestNeeded | Audit.Tests.ps1:349 and :355 read the in-memory SACL with .NET (non-matching entry kept, matching entry removed) and :427-432 assert one ReadSecurityError, no output and the SACL still empty; PermissionScopes.Tests.ps1:161-163 assert by Sid only. BoundBy 5 = scan 2 + PermissionScopes:159 (13 of 52 cases) + & $Command at Audit.Tests.ps1:425 and Access.Tests.ps1:881 (Should -Not -Throw only). | Partly | ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:256 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry | the item on disk untouched after the removal and the result after Set-NTFSSecurityDescriptor; the -PassThru output type; exceptions from the change itself (open item 1) | budget; budget; MaintainerDecision (open item) |
| 28 | audit | Clear-NTFSAudit | Path | True | 3 | 1 | 0 | 5 | Yes | Yes | No | Yes | NA | Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:455 Should remove the audit entries and keep the owner | Audit.Tests.ps1:478 Should write no error and leave the access entries unchanged | Audit.Tests.ps1:495 Should write an error and leave the item unchanged | 2 (NTFSSecurity.Live.Tests.ps1:652, plus :684 through & $Command that the scan cannot see): SMB share; explicit entry cleared with the inherited entry and the owner kept; the delegated account gets a ClearAclError that names the missing privilege and leaves the SDDL unchanged; the file server checks the SACL (:1453) | -DisableInheritance on a path is passed (Audit.Tests.ps1:629) but its end state (protected SACL, no copied inherited entries) is never asserted, and no test pipes paths or asserts the result of a succeeding path after a failing one. The owner retry after access denied cannot run on a local volume (Limit). | TestNeeded | Audit.Tests.ps1:457-459 asserts no error, owner kept (.NET) and no entry left (Get-NTFSAudit); :480-483 and :497-499 assert an unchanged DACL and, without the privilege, a ClearAclError with an unchanged SDDL; :631-669 and :672-679 add category and target. BoundBy 5 = scan 3 + & $Command at Audit.Tests.ps1:629 and PathErrors.Tests.ps1:124. | Partly | ParameterSets.Audit.Tests.ps1:339 Should clear the audit entries of each path taken from the pipeline and leave the DACL of each unchanged | ParameterSets.Audit.Tests.ps1:360 Should protect the SACL and not copy the parent's inherited entry when clearing a child path | the result of a succeeding path that follows a failing one; the owner retry after access denied | budget; Limit (needs a lab or a remote server) |
| 29 | audit | Clear-NTFSAudit | SD | False | 2 | 0 | 0 | 3 | Yes | Partly | No | No | NA | Audit.Tests.ps1:696 Should clear and protect the descriptor SACL without writing the <Type> | SecurityDescriptorSets.Tests.ps1:107 Clear-NTFSAudit should remove the explicit audit entries of the descriptor | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries | 0 | No test pipes descriptors or passes several (one without audit entries), and the error test asserts the ErrorId but not category or target. | TestNeeded | Audit.Tests.ps1:698-705 asserts the in-memory SACL cleared and protected (.NET), the SACL of the item untouched until Set-NTFSSecurityDescriptor, then the state on disk and an unchanged DACL; SecurityDescriptorSets.Tests.ps1:109-112 asserts the same for the unprotected form. BoundBy 3 = scan 2 + & $Command at Audit.Tests.ps1:425 (error case only). | Closed | ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:381 Should clear each piped descriptor that has an audit section and continue past one that does not | ||
| 30 | audit | Get-NTFSAudit | Path | False | 24 | 4 | 2 | 27 | NA | Partly | No | Partly | Partly | Audit.Tests.ps1:529 Should name the folder that an inherited entry comes from, also with -ExcludeExplicit | Audit.Tests.ps1:48 Should write an error without the Security privilege instead of returning nothing | PathErrors.Tests.ps1:124 <Command> should write a ReadFileError for it and continue with the next path | Inheritance.Tests.ps1:387 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged | 4 (NTFSSecurity.Live.Tests.ps1:336, 373, 656, 657): SMB share with domain accounts; Sid, AuditFlags and rights of the entry; the delegated account gets a ReadSecurityError that names the missing privilege | No test pipes paths or FileInfo/DirectoryInfo into it, asserts the category of its errors or the target of ReadSecurityError, or (in unit tests) the type, AuditFlags and inheritance flags of the output. No unit test has a failing path followed by a path whose entries are asserted (Audit.Tests.ps1:70-73 documents that the second path of the test at :80 no longer fails), and the PermissionDenied branch cannot run on a local volume (Limit). | TestNeeded | Audit.Tests.ps1:50-52 asserts one ReadSecurityError by ErrorId only (basic user); :531-534 and :577-578 assert IsInherited and InheritedFrom; PathErrors.Tests.ps1:130-132 asserts ReadFileError and target for a missing path but discards the output (:124). BoundBy 27 = scan 24 + PermissionScopes:163 (26 of 52 cases) + & $Command at PathErrors.Tests.ps1:124 and Owner.Tests.ps1:98 (no -Path, Should -Not -Throw). | Partly | ParameterSets.Audit.Tests.ps1:410 Should return the entries of the existing path in either position and a ReadFileError, category OpenError, for the missing one | ParameterSets.Audit.Tests.ps1:439 Should return the entries of each path object taken from the pipeline by value | ParameterSets.Audit.Tests.ps1:454 Should write a ReadSecurityError with category OpenError and the path as target without the Security privilege | the PermissionDenied category branch of ReadSecurityError | Limit (needs a lab or a remote server) |
| 31 | audit | Get-NTFSAudit | SD | False | 1 | 0 | 2 | 3 | NA | Partly | Partly | No | Partly | Audit.Tests.ps1:61 Should write an error for a security descriptor that was read without the audit entries | SecurityDescriptorSets.Tests.ps1:160 Get-NTFSAudit should return the audit entries that it returns for the path | PermissionScopes.Tests.ps1:163 Should add and remove <Name> using <Form> on <Source>, preserving the other account | 0 | The output is compared only with the output of the Path set (no expected type, flags or values), at most one descriptor is piped, and no test passes several descriptors (one without audit entries). The error test lacks category and target. | TestNeeded | Audit.Tests.ps1:63-65 asserts no output and one ReadSecurityError; SecurityDescriptorSets.Tests.ps1:160-163 pipes one descriptor and asserts one entry equal to the Path result (Sid, AccessRights, AuditFlags); PermissionScopes.Tests.ps1:163 asserts only emptiness after a removal. BoundBy 3 = scan 1 + SecurityDescriptorSets:160 (piped by value, so SD) + PermissionScopes:163 (26 of 52 cases). | Partly | ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:468 Should return the entries of the piped descriptor that has an audit section and continue past one that does not | an expected type, flags, or values for the output, independent of comparing it to the Path set's output | budget |
| 32 | audit | Get-NTFSOrphanedAudit | Path | False | 9 | 1 | 2 | 9 | NA | Partly | No | Yes | Yes | Audit.Tests.ps1:228 Should return one object per entry whose account cannot be resolved | Audit.Tests.ps1:250 Should return an inherited entry, and nothing with -ExcludeInherited | Audit.Tests.ps1:279 Should write an error for a path that does not exist and continue with the next path without the Security privilege | Audit.Tests.ps1:304 Should write a ReadSecurityError without the Security privilege instead of returning nothing | 1 (NTFSSecurity.Live.Tests.ps1:843): SMB share; the entry of a deleted domain account is returned with its SID, without error or warning | No test pipes paths into it, asserts the category of ReadError or ReadSecurityError, or runs -ExcludeExplicit, and the elevated continuation test passes on an empty result (Audit.Tests.ps1:273). | TestNeeded | Audit.Tests.ps1:230-232, :238-239 and :253-256 assert count, type, Sid and IsInherited; :282-286 (basic user) asserts ReadError for the missing path and a ReadSecurityError with its own target for the next path, which shows that the cmdlet continued, while :270-273 (elevated) asserts one error and then only a ForEach over the result. BoundBy 9 = scan 9. | Partly | ParameterSets.Audit.Tests.ps1:490 Should return the orphaned entries of each path taken from the pipeline and write a ReadError, category OpenError, for one that does not exist | the category of ReadSecurityError without the Security privilege; -ExcludeExplicit | budget; budget |
| 33 | audit | Get-NTFSOrphanedAudit | SD | False | 0 | 0 | 2 | 2 | NA | Partly | Partly | No | Partly | Audit.Tests.ps1:243 Should read the entries of a security descriptor | Audit.Tests.ps1:294 Should write an error for a security descriptor that was read without the audit entries | 0 | At most one descriptor is piped and none is passed in an array, so continuation is untested; -Account and -Exclude* with a descriptor, the entry type and Sid, and the category and target of the error are not asserted. | TestNeeded | Both calls pipe one descriptor, which PowerShell binds by value to -SecurityDescriptor (the elevated run of :296-298 proves it: a Path binding would return entries): :245-246 assert 2 entries with FullName and :296-298 assert no output and one ReadSecurityError. BoundBy 2 = the two ambiguous piped calls (Audit.Tests.ps1:243 and :294); the scan found 0. | Partly | ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:511 Should return the orphaned entries of the piped descriptor that has an audit section and continue past one that does not | ParameterSets.Audit.Tests.ps1:533 Should return the orphaned entries when -SecurityDescriptor is named directly | -Account and -ExcludeInherited/-ExcludeExplicit filters with a descriptor | budget |
| 34 | inheritance | Disable-NTFSAccessInheritance | Path | True | 9 | 1 | 0 | 16 | Partly | Partly | No | Partly | Yes | Inheritance.Tests.ps1:318 Should set enabled=<Enable> on a <Type>, remove requested entries=<Remove>, and report the written state | PathErrors.Tests.ps1:157 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | PathErrors.Tests.ps1:301 Disable-NTFSAccessInheritance should take ownership, protect the DACL, and set the owner back | Inheritance.Tests.ps1:133 <_> should write an error and return nothing when the security descriptor cannot be read | 1 (SMB as the delegated account, NTFSSecurity.Live.Tests.ps1:281-289: no error, owner Administrators kept, DACL protected by Get-Acl) | Not asserted: the error category (OpenError, WriteError), piped input (documented: Get-ChildItem2 | Disable-NTFSAccessInheritance -PassThru), a .NET readback of the kept or removed inherited entries (only Get-NTFSAccess reads them), RestoreOwnerError, -PassThru with a failing item among several, and the documented no-op when no -Path is given. | TestNeeded | Inheritance.Tests.ps1:341-360 asserts the -PassThru object (type, FullName, flag) and reads flag, owner and entries back only with Get-NTFSInheritance, Get-NTFSOwner and Get-NTFSAccess; the .NET readbacks assert flag and owner only (PathErrors.Tests.ps1:307-309 and 183-191, DriveRoot.Tests.ps1:113). Errors: PathErrors.Tests.ps1:110-112 and 180-182 assert ErrorId and target, never the category; no test pipes into the cmdlet. BoundBy 16 = scan 9 (6 are fixtures) + 7 calls through & $Command or & $_ (PathErrors:108,178; Inheritance:139,152,339,456; Privileges:123). | Partly | ParameterSets.Inheritance.Tests.ps1:178 Should set the DACL protected flag to <Enable> and the explicit/inherited rule counts for -Remove=<Remove> on a <Type>, read with Get-Acl | ParameterSets.Inheritance.Tests.ps1:345 <Command> should report <ErrorId> with category WriteError and target for the denied item, and still return the next item's new state with -PassThru | ParameterSets.Inheritance.Tests.ps1:368 <Command> should report RestoreOwnerError after a successful ownership retry and continue with the next path | ParameterSets.Inheritance.Tests.ps1:479 <Command> should take piped folders from Get-ChildItem2 and report the <Scope> inheritance state of each with -PassThru | OpenError category for a path that does not exist; the documented no-op without -Path | budget; budget |
| 35 | inheritance | Disable-NTFSAccessInheritance | SecurityDescriptor | False | 1 | 0 | 0 | 2 | Yes | NA | No | NA | Yes | SecurityDescriptorSets.Tests.ps1:71 Disable-NTFSAccessInheritance should protect the DACL of the descriptor and keep the inherited entries | Inheritance.Tests.ps1:543 <Command> should return the changed descriptor state without writing the <Type> | 0 | Not asserted: -RemoveInheritedAccessRules with a descriptor, the owner after the write, and several descriptors (array or pipeline). The set has no per-item handler, like the sets of open item 1 (which does not name it), but it cannot fail on a descriptor from Get-NTFSSecurityDescriptor. | TestNeeded | SecurityDescriptorSets.Tests.ps1:79-84 asserts the in-memory flag, the item unchanged before the write (Get-Acl), and after Set-NTFSSecurityDescriptor the flag and an explicit count equal to the inherited count (.NET); Inheritance.Tests.ps1:557-562 asserts count, FullName and flag of the -PassThru object. BoundBy 2 = scan 1 + Inheritance:555 (& $Command -SecurityDescriptor). | Partly | ParameterSets.Inheritance.Tests.ps1:255 <Command> -SecurityDescriptor should change the in-memory access entries per -<SwitchName>:<Remove>, applied to the item only after Set-NTFSSecurityDescriptor writes it | ParameterSets.Inheritance.Tests.ps1:513,547 <Command> -SecurityDescriptor should take two piped descriptors and report both in order, written only by Set-NTFSSecurityDescriptor | the owner unchanged after the descriptor write | budget |
| 36 | inheritance | Enable-NTFSAccessInheritance | Path | True | 3 | 1 | 0 | 10 | Partly | Partly | No | Partly | Yes | Inheritance.Tests.ps1:318 Should set enabled=<Enable> on a <Type>, remove requested entries=<Remove>, and report the written state | PathErrors.Tests.ps1:157 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | PathErrors.Tests.ps1:312 Enable-NTFSAccessInheritance should take ownership, let the DACL inherit, and set the owner back | DriveRoot.Tests.ps1:110 Should block and restore the access inheritance of the folder that the drive maps | 1 (SMB as the delegated account, NTFSSecurity.Live.Tests.ps1:291-299: no error, owner kept, DACL inherits again by Get-Acl) | Not asserted: the error category, piped input (documented: Get-NTFSInheritance output piped into Enable-NTFSAccessInheritance -RemoveExplicitAccessRules), a .NET readback of explicit and inherited entries after the call (only Get-NTFSAccess reads them), RestoreOwnerError, -PassThru with a failing item among several, and the documented no-op when no -Path is given. | TestNeeded | Inheritance.Tests.ps1:341-360 (Enable cases) asserts the object and reads re-inherited and explicit entries back only with Get-NTFSAccess; the .NET readbacks assert flag and owner only (PathErrors.Tests.ps1:319-321 and 190-191, DriveRoot.Tests.ps1:117). Errors as for Disable: ErrorId and target (PathErrors.Tests.ps1:110-112, 180-182), no category; no piped input. BoundBy 10 = scan 3 + 7 calls through & $Command or & $_ (PathErrors:108,178; Inheritance:139,152,339,456; Privileges:123). | Partly | ParameterSets.Inheritance.Tests.ps1:178 Should set the DACL protected flag to <Enable> and the explicit/inherited rule counts for -Remove=<Remove> on a <Type>, read with Get-Acl | ParameterSets.Inheritance.Tests.ps1:345 <Command> should report <ErrorId> with category WriteError and target for the denied item, and still return the next item's new state with -PassThru | ParameterSets.Inheritance.Tests.ps1:368 <Command> should report RestoreOwnerError after a successful ownership retry and continue with the next path | ParameterSets.Inheritance.Tests.ps1:479 <Command> should take piped folders from Get-ChildItem2 and report the <Scope> inheritance state of each with -PassThru | OpenError category for a path that does not exist; the documented no-op without -Path | budget; budget |
| 37 | inheritance | Enable-NTFSAccessInheritance | SecurityDescriptor | False | 1 | 0 | 0 | 2 | Partly | NA | No | NA | Yes | SecurityDescriptorSets.Tests.ps1:87 Enable-NTFSAccessInheritance should let the DACL of the descriptor inherit | Inheritance.Tests.ps1:543 <Command> should return the changed descriptor state without writing the <Type> | 0 | Not asserted: -RemoveExplicitAccessRules with a descriptor, that an explicit entry survives a plain Enable (the test descriptor has none), and several descriptors (array or pipeline). The set works in memory, so it has no error path or handler to test. | TestNeeded | SecurityDescriptorSets.Tests.ps1:94-99 asserts the in-memory flag, the item still protected, then (.NET) the flag false and inherited entries present after the write; the descriptor has no explicit entry, so kept versus removed is unasserted. Inheritance.Tests.ps1:557-562 (Enable cases) asserts count, FullName and flag. BoundBy 2 = scan 1 + Inheritance:555. | Closed | ParameterSets.Inheritance.Tests.ps1:255 <Command> -SecurityDescriptor should change the in-memory access entries per -<SwitchName>:<Remove>, applied to the item only after Set-NTFSSecurityDescriptor writes it | ParameterSets.Inheritance.Tests.ps1:513,547 <Command> -SecurityDescriptor should take two piped descriptors and report both in order, written only by Set-NTFSSecurityDescriptor | ||
| 38 | inheritance | Disable-NTFSAuditInheritance | Path | True | 7 | 1 | 0 | 15 | Partly | Yes | No | Yes | Yes | Audit.Tests.ps1:606 <Command> should use a held privilege or report a missing one and continue to the next path | Inheritance.Tests.ps1:378 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged | Inheritance.Tests.ps1:256 <Command> should set the audit inheritance of a <Type> and keep its access entries | Inheritance.Tests.ps1:113 <_> should return nothing when the audit change fails | 2 (SMB: Admin and ServerAdmin write it and the file server checks the SACL with Get-Acl -Audit, NTFSSecurity.Live.Tests.ps1:632 and 1453-1458; the delegated account gets ModifySdError naming the missing privilege and the folder stays unchanged, :684-690) | Unit tests read the SACL only through module cmdlets (no Get-Acl -Audit; the lab does, NTFSSecurity.Live.Tests.ps1:1453-1458), no test pipes into the set (documented: Get-ChildItem2 -Directory | Disable-NTFSAuditInheritance), and the documented no-op without -Path is untested. [Limit] The ownership retry and RestoreOwnerError of a SACL write cannot be provoked on a local volume (rule AUDIT-OWNER-RETRY). | TestNeeded | Audit.Tests.ps1:629-679 runs two paths with -PassThru: as a basic user ModifySdError/WriteError/target then ReadFileError/OpenError/target and an empty result (672-679), elevated the object flag, the explicit SACL rules and the unchanged DACL and owner (631, 654-657). Inheritance.Tests.ps1:401-419 reads the SACL back only through Get-NTFSInheritance and Get-NTFSAudit (the DACL through .NET at 405). BoundBy 15 = scan 7 + 8 calls through & $Command or & $_ (PathErrors:124; Inheritance:118,152,268,313,399; Privileges:123; Audit:629). | Partly | ParameterSets.Inheritance.Tests.ps1:220 Should set the SACL protected flag to <Enable> and the explicit/inherited audit-rule counts for -Remove=<Remove> on a <Type>, read with Get-Acl -Audit | ParameterSets.Inheritance.Tests.ps1:479 <Command> should take piped folders from Get-ChildItem2 and report the <Scope> inheritance state of each with -PassThru | the documented no-op without -Path; a successful ownership-retry/RestoreOwnerError of a SACL write | budget; Limit, rule AUDIT-OWNER-RETRY needs a remote/SMB target |
| 39 | inheritance | Disable-NTFSAuditInheritance | SecurityDescriptor | False | 1 | 0 | 0 | 2 | Partly | NA | No | NA | Yes | Inheritance.Tests.ps1:565 <Command> should return the changed audit state without writing the <Type> | Inheritance.Tests.ps1:276 Should add no SACL to a security descriptor that was read without its audit entries | 0 | Not asserted: -RemoveInheritedAuditRules with a descriptor, an independent SACL readback after the write, the owner and DACL after the write, and several descriptors. The set accepts a descriptor without audit entries silently (pinned for Disable at Inheritance.Tests.ps1:276), unlike Add, Remove and Clear-NTFSAudit; see the notes. | TestNeeded | Inheritance.Tests.ps1:579-585 (elevated only) asserts count, FullName and flag of the object, the SACL SDDL unchanged until Set-NTFSSecurityDescriptor, and the flag after it, all through module cmdlets; :284-286 asserts that no SACL is added to a descriptor read without audit entries. BoundBy 2 = scan 1 (Inheritance:282) + Inheritance:577 (& $Command -SecurityDescriptor). | Partly | ParameterSets.Inheritance.Tests.ps1:513,547 <Command> -SecurityDescriptor should take two piped descriptors and report both in order, written only by Set-NTFSSecurityDescriptor | -RemoveInheritedAuditRules with a descriptor as its own dedicated state test; the owner and DACL unchanged after the write | budget; budget |
| 40 | inheritance | Enable-NTFSAuditInheritance | Path | True | 1 | 1 | 0 | 9 | Partly | Yes | No | Yes | Yes | Audit.Tests.ps1:606 <Command> should use a held privilege or report a missing one and continue to the next path | Inheritance.Tests.ps1:378 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged | Inheritance.Tests.ps1:256 <Command> should set the audit inheritance of a <Type> and keep its access entries | PathErrors.Tests.ps1:118 <Command> should write a ReadFileError for it and continue with the next path | 2 (SMB: the file server checks the SACL with Get-Acl -Audit, NTFSSecurity.Live.Tests.ps1:642 and 1453-1458; the delegated account gets ModifySdError naming the missing privilege and the folder stays unchanged, :684-690) | Unit tests read the SACL only through module cmdlets (no Get-Acl -Audit), the result of -RemoveExplicitAuditRules is read back only with Get-NTFSAudit, no test pipes into the set (documented: Get-NTFSInheritance output piped into Enable-NTFSAuditInheritance), and the documented no-op without -Path is untested. [Limit] The ownership retry and RestoreOwnerError of a SACL write cannot be provoked on a local volume (rule AUDIT-OWNER-RETRY). | TestNeeded | Audit.Tests.ps1:660-662 (elevated) asserts the flag true and the explicit rules removed, and :672-679 the errors as a basic user; Inheritance.Tests.ps1:259-260 and 270-272 cover an item without SACL (flag by Get-NTFSInheritance, DACL by .NET). SACL state is never read with .NET in a unit test. BoundBy 9 = scan 1 (PipelineControl:284) + 8 calls through & $Command or & $_ (PathErrors:124; Inheritance:118,152,268,313,399; Privileges:123; Audit:629). | Partly | ParameterSets.Inheritance.Tests.ps1:220 Should set the SACL protected flag to <Enable> and the explicit/inherited audit-rule counts for -Remove=<Remove> on a <Type>, read with Get-Acl -Audit | ParameterSets.Inheritance.Tests.ps1:479 <Command> should take piped folders from Get-ChildItem2 and report the <Scope> inheritance state of each with -PassThru | the documented no-op without -Path; a successful ownership-retry/RestoreOwnerError of a SACL write | budget; Limit, rule AUDIT-OWNER-RETRY needs a remote/SMB target |
| 41 | inheritance | Enable-NTFSAuditInheritance | SecurityDescriptor | False | 1 | 0 | 0 | 2 | Partly | NA | No | NA | Yes | SecurityDescriptorSets.Tests.ps1:115 Enable-NTFSAuditInheritance should let the SACL of the descriptor inherit | Inheritance.Tests.ps1:565 <Command> should return the changed audit state without writing the <Type> | 0 | Not asserted: -RemoveExplicitAuditRules with a descriptor, that an explicit audit entry survives a plain Enable, an independent SACL readback after the write, and several descriptors. Enable with an access-only descriptor is pinned only through Set-NTFSInheritance (Inheritance.Tests.ps1:524-539). | TestNeeded | SecurityDescriptorSets.Tests.ps1:119-126 (elevated) asserts the in-memory flag, the item still protected (Get-NTFSInheritance) and the flag after the write; Inheritance.Tests.ps1:579-585 (Enable cases) asserts count, FullName and flag. Nothing reads the SACL with .NET. BoundBy 2 = scan 1 + Inheritance:577. | Partly | ParameterSets.Inheritance.Tests.ps1:513,547 <Command> -SecurityDescriptor should take two piped descriptors and report both in order, written only by Set-NTFSSecurityDescriptor | -RemoveExplicitAuditRules with a descriptor as its own dedicated state test; an explicit audit entry surviving a plain Enable | budget; budget |
| 42 | inheritance | Get-NTFSInheritance | Path | True | 23 | 4 | 0 | 27 | NA | Partly | No | Partly | Partly | PathErrors.Tests.ps1:104 <Command> should write a <ErrorId> for it and continue with the next path | PathErrors.Tests.ps1:140 <Command> should write a ReadSecurityError for it and continue with the next path | Inheritance.Tests.ps1:78 Should report the disabled audit inheritance of a <Type> as for its path | Inheritance.Tests.ps1:54 Should report the same state as for the path of the item | 4 (SMB: protected DACL with inherited audit flag, NTFSSecurity.Live.Tests.ps1:661-666; null audit state without the Security privilege, :695-700; two of the four calls are read-backs, :636 and :646) | Not asserted: FullName, Name, type or exact count of the output, a protected state created without the module (all protected states come from the module's own cmdlets), the error category, piped input (documented: Get-ChildItem2 | Get-NTFSInheritance), and the result for no -Path (documented: current location; Owner.Tests.ps1:92 asserts -Not -Throw only). [Limit] The documented ownership retry has no success path on a local volume. | TestNeeded | Inheritance.Tests.ps1:58-59, 74-75 and 88-90 assert only the flags (the descriptor result equals the -Path result; audit false after Disable-NTFSAuditInheritance), no FullName, type or count. PathErrors.Tests.ps1:110-115 and 147-152 assert ErrorId, target and non-empty output for the next path, no category. BoundBy 27 = scan 23 + 4 calls through & $Command or & $_ (PathErrors:108,145; Owner:98; Privileges:123). | Partly | ParameterSets.Inheritance.Tests.ps1:385 <Command> should write <ErrorId> with category OpenError for a path that does not exist, and return exactly one object for the next path | ParameterSets.Inheritance.Tests.ps1:564,573 Get-NTFSInheritance should take piped folder objects from Get-ChildItem2 and a piped custom object by its FullName property | the Name property of the output; a protected state created without the module; the result for no -Path; a successful ownership-retry read | budget; budget; budget; Limit, no local volume reaches the success path |
| 43 | inheritance | Get-NTFSInheritance | SecurityDescriptor | False | 4 | 0 | 0 | 4 | NA | NA | No | NA | Partly | Inheritance.Tests.ps1:54 Should report the same state as for the path of the item | Inheritance.Tests.ps1:65 Should report the same state as for the path of a <Type> without audit entries | Inheritance.Tests.ps1:78 Should report the disabled audit inheritance of a <Type> as for its path | Inheritance.Tests.ps1:93 Should report the audit inheritance as $null for a security descriptor without the audit entries | 0 | Not asserted: FullName, Name, type, exact count, several descriptors, a protected descriptor created without the module, and piped descriptors (documented: Get-NTFSSecurityDescriptor | Get-NTFSInheritance). The set works in memory and cannot fail on a readable descriptor. | TestNeeded | Inheritance.Tests.ps1:58-59, 74-75, 88-90 and 100-101 compare the flags with the -Path result and assert a null audit state for an access-only descriptor; none asserts FullName, Name, type, count or several descriptors. BoundBy 4 = scan 4. | Partly | ParameterSets.Inheritance.Tests.ps1:586,596 Get-NTFSInheritance -SecurityDescriptor should take two piped descriptors, one protected, and report both in order | the type of the output (BeOfType); a protected descriptor created without the module | budget; budget |
| 44 | inheritance | Set-NTFSInheritance | Path | True | 14 | 1 | 0 | 18 | Partly | Partly | No | Partly | Partly | Inheritance.Tests.ps1:164 Should keep the inherited access entries as explicit ones when it disables access inheritance | PathErrors.Tests.ps1:157 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | PathErrors.Tests.ps1:324 Set-NTFSInheritance should take ownership, protect the DACL, and set the owner back | Inheritance.Tests.ps1:422 Set-NTFSInheritance should re-enable audit inheritance on a <_> and keep its explicit audit entry | 1 (SMB as the delegated account, NTFSSecurity.Live.Tests.ps1:302-309: DACL protected, owner kept) | No test pipes into the set, including the documented round trip (Get-NTFSInheritance output piped into Set-NTFSInheritance, which binds both flags by property name); the SACL and the access-enable direction are read back only through module cmdlets. Also not asserted: the error category, the FullName of the -Path -PassThru object, RestoreOwnerError, -PassThru with a failing item among several, and the documented no-op without -Path. | TestNeeded | Inheritance.Tests.ps1:173-175 (.NET flag and explicit count), 428-433 (object, entries, DACL unchanged by .NET) and PathErrors.Tests.ps1:330-332 and 180-191 (owner, denied item unchanged, next item protected) are the strongest; the SACL and the access-enable direction are read back only with module cmdlets (Inheritance.Tests.ps1:371-373, 431-432). Inheritance.Tests.ps1:127-130 asserts no object after a failed audit change for one item, as a basic user only. BoundBy 18 = scan 14 + 4 calls through & $Command or & $_ (PathErrors:108,178; Inheritance:268; Privileges:123). | Partly | ParameterSets.Inheritance.Tests.ps1:345 <Command> should report <ErrorId> with category WriteError and target for the denied item, and still return the next item's new state with -PassThru | ParameterSets.Inheritance.Tests.ps1:368 <Command> should report RestoreOwnerError after a successful ownership retry and continue with the next path | ParameterSets.Inheritance.Tests.ps1:609 Set-NTFSInheritance should restore a saved inheritance state through the pipeline by property name | an independent SACL readback of the result; OpenError category for a path that does not exist; the documented no-op without -Path | budget; budget; budget |
| 45 | inheritance | Set-NTFSInheritance | SecurityDescriptor | False | 5 | 0 | 0 | 5 | Partly | NA | No | NA | Yes | Inheritance.Tests.ps1:465 Should set access inheritance enabled=<Enable> on a <Type> only when the descriptor is written | Inheritance.Tests.ps1:494 Should set audit inheritance enabled=<Enable> on a <Type> without changing its DACL or owner | Inheritance.Tests.ps1:524 Should keep audit inheritance unknown when requested enabled=<_> on an access-only descriptor | Inheritance.Tests.ps1:180 Should keep the inherited access entries of a security descriptor | 0 | Not asserted: several descriptors (array or pipeline), a single call that sets both -AccessInheritanceEnabled and -AuditInheritanceEnabled, and an independent SACL readback after the write (the audit side uses module cmdlets). The set works in memory and cannot fail on a readable descriptor. | TestNeeded | Inheritance.Tests.ps1:481-491 asserts count, FullName, Name, flag, the item unchanged until Set-NTFSSecurityDescriptor, then flag and owner by .NET and the explicit entry; :511-521 (elevated) does the audit side through module cmdlets; :533-539 asserts a null audit state and no SACL for an access-only descriptor. BoundBy 5 = scan 5. | Closed | ParameterSets.Inheritance.Tests.ps1:288 Set-NTFSInheritance -SecurityDescriptor should set both inheritance flags in one call, changing only the in-memory descriptor until it is written | ParameterSets.Inheritance.Tests.ps1:621,638 Set-NTFSInheritance -SecurityDescriptor should protect both descriptors in memory, written only by Set-NTFSSecurityDescriptor, piped and passed directly to the parameter | ||
| 46 | inheritance | Get-NTFSOwner | Path | True | 22 | 4 | 3 | 26 | NA | Partly | Partly | Partly | Yes | Owner.Tests.ps1:47 Should write one permission error and keep the owner | PathErrors.Tests.ps1:140 <Command> should write a ReadSecurityError for it and continue with the next path | DriveRoot.Tests.ps1:45 Get-NTFSOwner should return the owner of the root folder | ObjectApis.Tests.ps1:725 Should name the item and the account of an owner object | 4 (SMB: owner Administrators, NTFSSecurity.Live.Tests.ps1:585-589; three calls check that the privileges are disabled after a later command ends the pipeline, :1406, 1411, 1422) | No test asserts ErrorId, category and target together (Owner.Tests.ps1:55-56 id and category, PathErrors.Tests.ps1:148-149 id and target); piping covers one FileInfo only (documented: Get-ChildItem2 -Recurse | Get-NTFSOwner); the next item's output is asserted only as non-empty; the documented 'returns nothing' without -Path is untested. | TestNeeded | Owner.Tests.ps1:53-56 asserts no output, one error, ReadSecurityError and PermissionDenied (basic user only, skipped with the Backup privilege); PathErrors.Tests.ps1:147-151 asserts id, target and non-empty output for the next path; DriveRoot.Tests.ps1:46 compares Owner.Sid with Get-Acl; ObjectApis.Tests.ps1:730-732 (line numbers at HEAD 6696f68; +19 in a work tree with the uncommitted ObjectApis edit) asserts Item, FullName and Account. BoundBy 26 = scan 22 + ambiguous Owner:177 and :185 (both bind Path) + PathErrors:108,145. | Partly | ParameterSets.Inheritance.Tests.ps1:400 Get-NTFSOwner should write a ReadSecurityError with its id, category, and target together for a denied item, and return exactly one object for the next path | ParameterSets.Inheritance.Tests.ps1:652 Get-NTFSOwner should take two piped folders from Get-ChildItem2 and return the owner of each, verified with Get-Acl | the documented 'returns nothing' without -Path | budget |
| 47 | inheritance | Get-NTFSOwner | SecurityDescriptor | False | 0 | 0 | 3 | 1 | NA | NA | Partly | NA | Partly | SecurityDescriptorSets.Tests.ps1:146 Get-NTFSOwner should return the owner that it returns for the path | 0 | One test, one descriptor; the owner is compared with the -Path result of the same cmdlet, with no .NET oracle, no type assertion and no several descriptors. The result for a descriptor read without its Owner section is unexercised (see the notes). | TestNeeded | The scan's ambiguous rows Owner.Tests.ps1:177 (System.IO DirectoryInfo by position) and :185 (System.IO FileInfo piped) bind Path: FileSystemPathTransformation turns a file system object into its path, and those types do not convert to FileSystemSecurity2[]. Only SecurityDescriptorSets.Tests.ps1:149-153 binds the set: a FileSystemSecurity2 piped by value, asserting count 1, Owner.Sid against the -Path result and FullName. BoundBy 1 (scan 0 + that call). | Partly | ParameterSets.Inheritance.Tests.ps1:676,686 Get-NTFSOwner -SecurityDescriptor should return the owner of each descriptor, piped and passed directly to the parameter, verified with Get-Acl | the result for a descriptor read without its Owner section | budget, a read-only probe just now shows it returns the item's real owner, not a crash, so it is safely testable and simply was not written |
| 48 | inheritance | Set-NTFSOwner | Path | True | 8 | 4 | 1 | 10 | Partly | Partly | Yes | Partly | Yes | Owner.Tests.ps1:240 Should set an owner that only the Restore privilege allows | Owner.Tests.ps1:232 Should take the items from the pipeline | Owner.Tests.ps1:270 Should write a SetOwnerError and keep the owner | Owner.Tests.ps1:248 Should write a read error for a path that does not exist and continue with the next path | 4 (SMB: take ownership as the account itself, assign another account only with the file server's Restore privilege (SetOwnerError for the delegated account), NTFSSecurity.Live.Tests.ps1:595 and 604; a later command that stops the pipeline leaves the second item's owner unchanged, :1143, 1182) | Not asserted: DACL, SACL and group unchanged after the owner changes; as a basic user the owner already equals the user, so Owner.Tests.ps1:217, 229 and 256 cannot show a change; the error category and target (SetOwnerError); -PassThru with a failing item among several; and the documented no-op without -Path. | TestNeeded | Owner.Tests.ps1:245 (.NET owner is TrustedInstaller, needs the Restore privilege), :225-229 (count, type, FullName, Owner.Sid, .NET owner), :237 (two piped Get-Item2 objects) and :277-279 (SetOwnerError id only, owner unchanged). The scan's ambiguous Owner:235 binds Path (the Get-Item2 objects bind by their FullName property). BoundBy 10 = scan 8 + Owner:235 + PathErrors:108. | Partly | ParameterSets.Inheritance.Tests.ps1:314 Set-NTFSOwner should change only the owner and leave the Access entries and the group unchanged | ParameterSets.Inheritance.Tests.ps1:427,444 Should write <ErrorId> with its category and target for <Scenario>, and keep processing the remaining path | the SACL unchanged after the owner changes; the documented no-op without -Path | budget; budget |
| 49 | inheritance | Set-NTFSOwner | SecurityDescriptor | False | 2 | 0 | 1 | 2 | Partly | NA | No | NA | Partly | Owner.Tests.ps1:284 Should change only the descriptor in memory until Set-NTFSSecurityDescriptor writes it | Owner.Tests.ps1:303 Should write nothing without -PassThru and leave the owner of the item unchanged | 0 | The persisted-owner test is skipped for basic users (Owner.Tests.ps1:287-290); not asserted: DACL unchanged after the write, FullName and type of the -PassThru object (only the -Path set asserts them), and several descriptors (array or pipeline). | TestNeeded | Owner.Tests.ps1:296-300 asserts count, Owner.Sid, the item's owner unchanged until Set-NTFSSecurityDescriptor and changed after (.NET), but the test is skipped when the user owns new items (:287-290); :312-314 asserts no output without -PassThru, the in-memory owner and the item's owner unchanged. BoundBy 2 = scan 2. | Partly | ParameterSets.Inheritance.Tests.ps1:698,713 Set-NTFSOwner -SecurityDescriptor should change both owners in memory without touching the items, piped and passed directly to the parameter | the DACL unchanged after the write; the type of the -PassThru object (BeOfType) | budget; budget |
| 50 | inheritance | Get-NTFSSecurityDescriptor | __AllParameterSets | False | 79 | 5 | 0 | 82 | NA | Partly | No | Partly | Yes | SecurityDescriptor.Tests.ps1:52 Should report the inherited access entries as inherited | SecurityDescriptor.Tests.ps1:63 Should read the owner and the audit entries with the access entries | DriveRoot.Tests.ps1:39 Get-NTFSSecurityDescriptor should read the DACL of the root folder | PathErrors.Tests.ps1:140 <Command> should write a ReadSecurityError for it and continue with the next path | 5 (SMB read-backs for the descriptor tests, NTFSSecurity.Live.Tests.ps1:315, 965, 1150, and InheritedFrom of a vanished item, :988, 1017) | Untested combinations: piped paths and file or folder objects (documented: Get-ChildItem2 | Get-NTFSSecurityDescriptor), no -Path (current location; Owner.Tests.ps1:92 asserts -Not -Throw only), the error category, and that the next item yields exactly one descriptor. [Limit] The documented ownership retry has no success path on a local volume. | TestNeeded | SecurityDescriptor.Tests.ps1:59-60 (inherited flags against the Get-Acl count) and :70-71 (owner against Get-Acl, audit rules) need the Security privilege; DriveRoot.Tests.ps1:42 compares the DACL SDDL with Get-Acl; PathErrors.Tests.ps1:110-115 and 147-152 assert ReadFileError and ReadSecurityError with target and non-empty output. BoundBy 82 = scan 79 + 3 calls through & $Command or & $_ (PathErrors:108,145; Owner:98). | Partly | ParameterSets.Inheritance.Tests.ps1:385 <Command> should write <ErrorId> with category OpenError for a path that does not exist, and return exactly one object for the next path | ParameterSets.Inheritance.Tests.ps1:727,738,745 Get-NTFSSecurityDescriptor should take piped folder objects, a standard Get-Item object, and a piped custom object by its Path property | the result for no -Path (current location); a successful ownership-retry read | budget; Limit, no local volume reaches the success path |
| 51 | inheritance | Set-NTFSSecurityDescriptor | __AllParameterSets | False | 29 | 4 | 0 | 29 | Yes | Yes | Yes | Yes | Yes | SecurityDescriptor.Tests.ps1:299 Should report a denied write, return no failed item, and write the next descriptor | SecurityDescriptor.Tests.ps1:249 Should report RestoreOwnerError for a previous owner that it cannot set back after the write | SecurityDescriptor.Tests.ps1:213 Should return the written descriptor with -PassThru also when it took ownership for the write | SecurityDescriptor.Tests.ps1:133 Should not write back the access entries of an unchanged descriptor | 4 (SMB: writes the added entry and keeps the owner, NTFSSecurity.Live.Tests.ps1:317; writes the cleared DACL without RestoreOwnerError, :968; a later command that stops the pipeline leaves the second descriptor unwritten, :1154, 1165) | Untested combinations: positional binding (declared Position 2), the by-property-name pipeline form, and the category and target of the -PassThru ReadSecurityError (only its ErrorId is asserted, SecurityDescriptor.Tests.ps1:361). [Limit] A failing SACL write needs a lab. | None | SecurityDescriptor.Tests.ps1:308-317 pipes two descriptors with -PassThru and asserts WriteSdError, category WriteError, target, the denied item's SDDL unchanged (.NET), one object for the next item and its entry; :259-264 asserts RestoreOwnerError with category and target; :223-226 asserts the -PassThru object after an ownership retry. BoundBy 29 = scan 29 (no calls through variables). | None | positional binding at Position 2; the by-property-name pipeline form; category and target of the -PassThru ReadSecurityError | would-pin, Position 2 vs siblings' Position 1 looks like an undecided inconsistency per the notes; budget, row judged GapKind None; budget, row judged GapKind None | |
| 52 | items | Copy-Item2 | __AllParameterSets | False | 6 | 4 | 0 | 20 | Yes | Yes | No | Yes | Partly | ItemCmdlets.Tests.ps1:786 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:815 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:635 <_> should write DestinationFileAlreadyExists for a folder that exists at the destination and change nothing | ItemCmdlets.Tests.ps1:674 Copy-Item2 -Force should copy a folder into an existing folder of the same name and replace the files in both | 4: -WhatIf onto an existing file on a share (#108, administrator); copy of a file and a folder as the delegated account; later-command stop on a share | No test pipes paths into it (documented: Get-ChildItem2 | Copy-Item2 -Destination), passes an empty or null -Path, a FileInfo object, a path with brackets, a path over 260 characters or a drive root, and -Force replacing an existing file is covered only through the folder merge. FileNotFound and the file case of DestinationFileAlreadyExists are asserted by error count only, and -PassThru asserts FullName but not the output type or that nothing is written without it. | TestNeeded | ItemCmdlets.Tests.ps1:786-801 and :815-827 assert ErrorId, category, target, exception type, only the second item's result and untouched sources; :605-613 and :644-649 read the folder conflict and the merge back; Owner.Tests.ps1:160-163 reads the copied content. 14 of the 20 call sites are '& $Command' calls in ItemCmdlets.Tests.ps1 (lines 514 to 814) that the scan does not resolve. | Partly | ParameterSets.Items.Tests.ps1:36 <Command> should accept <InputKind> piped by value and still process the surrounding items | ParameterSets.Items.Tests.ps1:229 <Command> should reject -Path <CaseName> instead of silently using the current location | a path with brackets; a path over 260 characters; a drive root; -Force replacing an existing file (still only covered through the folder merge); the file case of DestinationFileAlreadyExists with category/target (still error count only); -PassThru output type; that nothing is written without -PassThru | budget (all items; none needs a lab, none pins an open maintainer decision) |
| 53 | items | Get-ChildItem2 | __AllParameterSets | False | 34 | 8 | 0 | 36 | NA | Yes | No | Yes | Yes | ItemCmdlets.Tests.ps1:98 Should apply <Case> without broadening the other attribute filters | ItemCmdlets.Tests.ps1:137 Should return the exact tree for <Case> | ItemCmdlets.Tests.ps1:312 Should report the denied folder and continue with the next path | ItemCmdlets.Tests.ps1:370 Should report a junction whose target was removed as a DirUnspecifiedError and continue with the next folder | 8: over SMB: path over 260 characters (administrator), -Hidden and a listing (delegated account), -Filter cases, later-command stop with a denied nested folder | No test pipes folders or strings into -Path (documented by value and by FullName), asserts the result of omitting -Path or of a relative -Path (Owner.Tests.ps1:98 only asserts no throw), or lists a drive root or a path over 260 characters in a unit test. -Directory with -File, -Attributes with -Force/-Hidden/-System/-ReadOnly (documented: ignored), -Depth without -Recurse and the dir2 alias are unasserted, and FileNotFound and AttributesEmpty are asserted without category (and without target for AttributesEmpty); the -Filter dot rules are pinned already and are the maintainer's, so they are not counted here. | TestNeeded | ItemCmdlets.Tests.ps1:98-100 and :137-140 assert exact name sets for ten attribute-switch cases and for the Recurse/Depth/Directory/File/Filter cases; :282-289 and :340-348 assert ErrorId, category, target (and exception type) and that the next path or sibling is still listed; :44-49 and :402-406 assert the AlphaFS types; PathErrors.Tests.ps1:108-114 covers FileNotFound (ID and target only). | Partly | ParameterSets.Items.Tests.ps1:91 Should accept piped folders by value, write one error for a path that does not exist, and list the items of the other folders | ParameterSets.Items.Tests.ps1:111 Should accept folder objects piped from Get-ChildItem2 -Directory and list only the files directly below them | the result of an omitted -Path; the result of a relative -Path; a drive root in a unit test; a path over 260 characters in a unit test; -Directory with -File together; -Attributes with -Force/-Hidden/-System/-ReadOnly; -Depth without -Recurse; the dir2 alias; AttributesEmpty category and target | budget (all items; the -Filter dot rules are the maintainer's and were already excluded from this Gap) |
| 54 | items | Get-Item2 | __AllParameterSets | False | 17 | 1 | 0 | 19 | NA | Partly | No | Partly | Partly | PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | ItemCmdlets.Tests.ps1:965 Get-Item2 should resolve <Path> against the current location | Owner.Tests.ps1:235 Should take the items from the pipeline | PipelineControl.Tests.ps1:124 <Name> should stop after the first object for Select-Object -First 1 and change nothing else | 1: FullName and Length of a file on a share (delegated account) | No test pipes paths into it (documented: 'C:\Data','C:\Data\Reports' | Get-Item2) or omits -Path (documented: the current location), and the output type (FileInfo or DirectoryInfo) and the Mode property are never asserted; bracket paths, paths over 260 characters and a drive root are untested. The FileNotFound category is not asserted and the output for the next path is checked only as non-empty. | TestNeeded | PathErrors.Tests.ps1:108-114 asserts one FileNotFound error with the missing path as target and non-empty output for the next path; ItemCmdlets.Tests.ps1:965-973 asserts HaveCount 1 and FullName for six relative paths. 15 of the 17 scan calls are fixtures that feed descriptors or other cmdlets (Access, Audit, Inheritance, ObjectApis, Owner, SecurityDescriptor). | Partly | ParameterSets.Items.Tests.ps1:133 Should accept piped items by value, return each in order with its output type, and write one error for a path that does not exist | an omitted -Path defaulting to the current location; bracket paths; paths over 260 characters; a drive root | budget (all items) |
| 55 | items | Move-Item2 | __AllParameterSets | False | 7 | 3 | 0 | 21 | Yes | Yes | No | Yes | Yes | ItemCmdlets.Tests.ps1:786 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:815 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:651 Move-Item2 -Force should replace an existing file with PassThru=<_> | ItemCmdlets.Tests.ps1:871 Should refuse to move <Kind> folder to another volume and leave it in place | 3: -WhatIf onto an existing file on a share (administrator); move of a file as the delegated account; later-command stop on a share | No test pipes paths into it (documented), passes an empty or null -Path, moves a non-empty folder tree, or renames an item inside one folder on the same volume (the cross-volume cases need an elevated admin share), and -Force replacing a folder, bracket or wildcard paths, paths over 260 characters and a drive-root destination are untested. FileNotFound is asserted by error count only. | TestNeeded | ItemCmdlets.Tests.ps1:651-661 asserts the source is gone, the content at the destination and PassThru true and false; :576-592 asserts the moved file and folder (DirectoryInfo) and the removed source folder; :756-771 and :785-797 assert ErrorId, category, target, exception type and the other item's result. The cross-volume tests at :841-878 skip without an elevated admin share. | Partly | ParameterSets.Items.Tests.ps1:36 <Command> should accept <InputKind> piped by value and still process the surrounding items | ParameterSets.Items.Tests.ps1:229 <Command> should reject -Path <CaseName> instead of silently using the current location | moving a non-empty folder tree; renaming an item in place on the same volume; -Force replacing a folder; bracket or wildcard paths; paths over 260 characters; a drive-root destination | budget (all items) |
| 56 | items | Remove-Item2 | __AllParameterSets | False | 15 | 2 | 0 | 16 | Yes | Yes | No | Yes | Partly | Remove-Item2.Tests.ps1:43 Should report DeleteError for a non-empty folder without -Recurse and continue with the next path | Remove-Item2.Tests.ps1:104 Should write DeleteError when a descendant is open without delete sharing, not a successful -PassThru result | Remove-Item2.Tests.ps1:126 Should delete a junction with -Recurse without deleting or changing its target | Remove-Item2.Tests.ps1:77 Should leave a folder tree unchanged with -Recurse -Force -WhatIf and write nothing with -PassThru | 2: removal of a file on a share as the delegated account; later-command stop on a share | No test pipes items into it (documented: Get-ChildItem2 ... | Remove-Item2), omits -Path (documented: the cmdlet does nothing), passes an empty or null -Path (the ValidateNotNullOrEmpty guard that keeps it from meaning the current location), passes bracket or wildcard paths (documented: literal) or uses rm2/del2. FileNotFound is asserted by error count only (ItemCmdlets.Tests.ps1:537), the access-denied branch of DeleteError (category NotSpecified) is unasserted, and that a successful removal without -PassThru writes nothing is not asserted. | TestNeeded | Remove-Item2.Tests.ps1:43-52 asserts DeleteError, InvalidData, target, kept content, the removed next item and exactly one result; :104-114 and :152-158 assert DeleteError and no success-shaped result with the content kept; :126-130 asserts the junction is removed and its target content and SDDL are unchanged; :176-184 covers the -PassThur alias. | Partly | ParameterSets.Items.Tests.ps1:157 Should accept piped items by value, write one error for a non-empty folder, remove the files, and keep the folder | ParameterSets.Items.Tests.ps1:185 Remove-Item2 should reject -Path <CaseName> instead of removing the current location | -Path omitted entirely (documented: the cmdlet does nothing); bracket or wildcard paths; the rm2/del2 aliases; FileNotFound category/target (still error count only); the access-denied DeleteError branch (category NotSpecified); that a successful removal without -PassThru writes nothing | budget (all items) |
| 57 | items | Test-Path2 | __AllParameterSets | False | 14 | 3 | 0 | 14 | NA | NA | Partly | Yes | Yes | ItemCmdlets.Tests.ps1:997 Should return <Expected> for a <Kind> with -PathType <PathType> | ItemCmdlets.Tests.ps1:1039 Should return $false for a path with the character <_> and continue with the next path | ItemCmdlets.Tests.ps1:1030 Should find a folder whose path is longer than 260 characters | ItemCmdlets.Tests.ps1:1011 Should take the items from the pipeline | 3: file, folder and missing item with -PathType on a share (delegated account) | The pipeline test pipes one file; no test pipes several items (documented: Get-ChildItem2 -Recurse | Test-Path2 -PathType Leaf) or objects with PathType by property name, or tests a drive root, a UNC path or a bracket path. Errors are NA because the cmdlet writes $false for a missing or invalid path; its PathNotFound handler looks unreachable (see the notes). | TestNeeded | ItemCmdlets.Tests.ps1:997-1002 asserts one [bool] with the expected value for file, folder and missing item under all three -PathType values; :1009-1013 asserts no error and 'False,True' for six invalid characters followed by a valid path; :981-983 pipes one FileInfo; :992-1001 covers a folder path over 260 characters. | Open | piping several items into -Path; -PathType bound by property name; a drive root; a UNC path; a bracket path | budget (deprioritized: PipelineInput was already Partly, not No, so lower priority than the cmdlets with no pipeline test at all) | |
| 58 | items | Get-FileHash2 | __AllParameterSets | False | 12 | 2 | 0 | 13 | Partly | Partly | Partly | Partly | Yes | FileHash.Tests.ps1:41 Should return the hash of Get-FileHash for <_> | FileHash.Tests.ps1:94 Should skip the folder and hash the files that follow it | FileHash.Tests.ps1:108 Should write an error and no result for the file | FileHash.Tests.ps1:153 Should report both the failed read and the failed owner restoration without returning a hash | 2: SHA256 equals Get-FileHash on a share (delegated account); later-command stop at the verbose message | No test pipes FileInfo/DirectoryInfo objects or folders (documented: Get-ChildItem2 -Recurse | Get-FileHash2) or Algorithm by property name, hashes a relative path or a path over 260 characters, or puts the failing path first and asserts the next hash; no error category is asserted. The owner-restore tests run only elevated and read the owner back with Get-NTFSOwner, and the retry that succeeds after taking ownership is untested. | TestNeeded | FileHash.Tests.ps1:41-44 compares Hash and Algorithm with Get-FileHash for five algorithms; :94-98 skips a folder and hashes the next file with the SHA256 default; :108-115 asserts one error and no result for a locked file; :153-160 (elevated only) asserts RestoreOwnerError and GetHashError with target, no result and the restored owner; OutputTypes.Tests.ps1:57 asserts the type name. | Partly | ParameterSets.Items.Tests.ps1:531 Should accept Get-ChildItem2 objects piped by value, skip a folder, and match Get-FileHash for each file | ParameterSets.Items.Tests.ps1:565 Should write GetHashError with its category for a locked file first, hash the file that follows it, and resolve a relative path | -Algorithm bound by property name from the pipeline; a path over 260 characters; the ownership-retry-after-taking-ownership success path | -Algorithm by property name and >260 chars: budget; ownership-retry success: Limit (elevated-only, needs a DACL/owner setup not shown buildable) |
| 59 | items | Get-DiskSpace | __AllParameterSets | False | 6 | 0 | 0 | 6 | NA | Partly | NA | No | Yes | ItemCmdlets.Tests.ps1:1068 Should return the size of the system drive | ItemCmdlets.Tests.ps1:1086 Should return the volumes with a size greater than zero without -DriveLetter | ItemCmdlets.Tests.ps1:1102 Should warn and return nothing for a drive letter without a volume | ItemCmdlets.Tests.ps1:1110 Should reject a drive letter without a colon | 0 | No test passes several drive letters, so the documented warn-and-continue for a letter without a volume is never combined with a valid letter; lower-case letters, positional binding and the free-space values against an independent source are unasserted. The validation error is asserted by ErrorId only (no category or target). | TestNeeded | ItemCmdlets.Tests.ps1:1068-1073 asserts type, DriveName and TotalNumberOfBytes against System.IO.DriveInfo; :1072-1077 asserts the exact warning text and no output or error for a letter without a volume; :1056-1061 asserts every volume has a size above zero and the system drive is included; :1080-1081 asserts the ErrorId of the validation error. | Partly | ParameterSets.Items.Tests.ps1:470 Should return only the system drive and warn for a drive letter without a volume, regardless of order (<Order>) | ParameterSets.Items.Tests.ps1:491 Should accept a lower-case drive letter positionally and report the same total size as .NET | the free-space values (TotalNumberOfFreeBytes/FreeBytesAvailable) against an independent source (only TotalNumberOfBytes was compared); the validation error's category and target (still ErrorId only) | budget (both items) |
| 60 | items | New-NTFSHardLink | __AllParameterSets | False | 14 | 2 | 0 | 17 | Yes | Yes | Yes | Yes | Yes | Links.Tests.ps1:134 Should write a non-terminating error for each link that it cannot create and continue with the next one | Links.Tests.ps1:170 Should write a PermissionDenied error and create no link in a folder that denies new files | Links.Tests.ps1:67 Should return every name of the file with -PassThru | Links.Tests.ps1:79 Should give both names the same data | 2: link creation on a share (administrator) and -PassThru, which writes GetHardLinkError there | Positional binding (documented example 2), a FileInfo object bound to -Path or -Target and the end of a pipeline by a later command are untested; the -PassThru GetHardLinkError on a share is asserted by ErrorId only (no category or target) and only with an elevated admin share. A hard link across volumes cannot be built on a one-volume host. | TestNeeded | Links.Tests.ps1:134-145 pipes four objects by property name and asserts three errors (ErrorId, categories, targets, message), the created link and unchanged files; :170-179 asserts PermissionDenied, exception type, no output and no link; :36-41, :67-73 and :79-84 read back existence, all names and the shared data. Three of the 17 call sites (Links.Tests.ps1:450, 468, 494) are '& $Command' calls that the scan does not resolve. | Partly | ParameterSets.Items.Tests.ps1:264 <Command> should reject <CaseName> instead of creating a link to the current folder | ParameterSets.Items.Tests.ps1:324 New-NTFSHardLink should stop after the first pass-through object for Select-Object -First 1 and leave the second request untouched | positional binding (documented example 2); a FileInfo object bound to -Path or -Target; the -PassThru GetHardLinkError category and target on an admin share (still ID only) | budget (all items; an elevated admin share is already available on this host, simply not used for this) |
| 61 | items | Get-NTFSHardLink | __AllParameterSets | False | 9 | 1 | 0 | 10 | NA | Partly | Yes | Yes | Partly | Links.Tests.ps1:224 Should write an error for a path that does not exist and continue with the next path | Links.Tests.ps1:236 Should write an error for a folder and continue with the next path | Links.Tests.ps1:214 Should take the files with more than one name from Get-ChildItem2 | Links.Tests.ps1:200 Should return every name of a file with hard links | 1: writes GetHardLinkError on a share (administrator) | The output type is never asserted (only FullName and Mode), the error categories (InvalidArgument for a folder, ObjectNotFound, ReadError on a share) are unasserted, and positional binding and strings from the pipeline are untested. The UnauthorizedAccessException handler cannot be reached by a test because Windows lists the names without opening the file (Links.Tests.ps1:262). | TestNeeded | Links.Tests.ps1:224-229 and :236-243 assert one error (FileNotFound; GetHardLinkError with target and message) and exactly the next file; :214-218 pipes AlphaFS file objects and asserts the names of both linked files and not the third; :200-203 asserts all names of a linked file; PathErrors.Tests.ps1:108-114 asserts ID and target for a missing path. | Partly | ParameterSets.Items.Tests.ps1:297 Should accept piped strings by value, write errors with their categories for a folder and a missing path, and return the files in order | the ReadError category on a network share (still ID/target only); the UnauthorizedAccessException handler | ReadError on a share: budget (admin share available elevated, not implemented here); UnauthorizedAccessException handler: Limit (structurally unreachable, Windows lists hard-link names without opening the file) |
| 62 | items | New-NTFSSymbolicLink | __AllParameterSets | False | 12 | 2 | 0 | 15 | Yes | Yes | Yes | Partly | Yes | Links.Tests.ps1:297 Should create a link to a file that reads the data of the file | Links.Tests.ps1:387 Should write a non-terminating error for an existing -Path and continue with the next link | Links.Tests.ps1:420 Should write a PermissionDenied error and create no link in a folder that denies new files | Links.Tests.ps1:335 Should return a folder object for a link to a folder with -PassThru | 2: link to a file and to a folder on a share (administrator); asserts no error only | No test creates a link after a failed one in a pipeline (every piped request fails so that the tests run without the privilege), and a link to a folder is checked only for the Directory attribute and reachability through Test-Path2, not for LinkType and target. The success paths run only with SeCreateSymbolicLinkPrivilege; positional binding and an empty -Target (the value that meant the current folder before rc7, while the tests check only the Mandatory metadata) are untested. | TestNeeded | Links.Tests.ps1:297-302 reads back LinkType, target and data of a file link; :387-393 pipes two objects by property name and asserts two errors (ErrorId, categories) and that no link exists; :420-429 asserts PermissionDenied, exception type and no output; :323-339 assert FileInfo and DirectoryInfo with -PassThru. | Partly | ParameterSets.Items.Tests.ps1:264 <Command> should reject <CaseName> instead of creating a link to the current folder | ParameterSets.Items.Tests.ps1:343 New-NTFSSymbolicLink should stop after the first pass-through object for Select-Object -First 1 and leave the second request untouched | ParameterSets.Items.Tests.ps1:367 Should write one ResourceExists error for an existing -Path and still create the links for the requests that follow it | positional binding; the folder link's LinkType and resolved target (only the file link's LinkType was asserted) | budget (both items) |
| 63 | items | Enable-Privileges | __AllParameterSets | False | 5 | 0 | 0 | 7 | Partly | No | NA | NA | Partly | Privileges.Tests.ps1:61 Should disable the privileges that Enable-Privileges enabled | Privileges.Tests.ps1:284 Should enable the privileges when the module setting EnablePrivileges is $true | Privileges.Tests.ps1:302 Should enable the privileges in a script of another name also when the module setting EnablePrivileges is $false | Privileges.Tests.ps1:179 Enable-Privileges should keep the privileges enabled also when the pipeline stops early | 0 | The error path (Enable Privilege Error, SecurityError, 'Could not enable requested privileges' when not all four privileges can be enabled) is never asserted, although OutputTypes.Tests.ps1:86 (in a token without the privileges) and the partial-token child script at Privileges.Tests.ps1:93 run it with errors suppressed. Only the Backup state is read back, only through Get-Privileges and only with all four privileges held, and the states in the -PassThru objects are unasserted. | TestNeeded | Privileges.Tests.ps1:61-62 reads the Backup state after Enable-Privileges; :281-305 run it in child scripts and assert the Backup state and the verbose announcement for the Init script with the setting true and false and for another script name; :179-181 asserts the state stays enabled when the pipeline stops; OutputTypes.Tests.ps1:86-89 compares the -PassThru count with Get-Privileges. All but OutputTypes.Tests.ps1:86 skip unless the token holds the four privileges. | Partly | ParameterSets.Items.Tests.ps1:441 Enable-Privileges should write Enable Privilege Error with SecurityError and AdjustPriviledgeException when it cannot enable all four privileges | the -PassThru privilege states (TakeOwnership/Restore/Backup/Security) with an independent read-back beyond Get-Privileges, only verifiable elevated | budget |
| 64 | items | Disable-Privileges | __AllParameterSets | False | 19 | 3 | 0 | 20 | Partly | No | NA | NA | Partly | Privileges.Tests.ps1:64 Should disable the privileges that Enable-Privileges enabled | Privileges.Tests.ps1:94 Should not warn about the privileges that the access token does not hold | OutputTypes.Tests.ps1:95 Disable-Privileges should write one object per privilege | Privileges.Tests.ps1:382 Should not fail when Disable-Privileges runs inside the pipeline | 3: AfterAll/BeforeEach/AfterEach resets in the privileges-on-share tests; no assertion on the cmdlet itself | The error path (Disable Privilege Error, documented as non-terminating, when none of TakeOwnership, Restore and Backup is enabled) is never asserted although 15 of the 19 scan calls (BeforeEach/AfterEach/AfterAll) run it with errors suppressed; -PassThru asserts only a count above 1 and the type, and the warning for a privilege that cannot be disabled is unasserted. | TestNeeded | Privileges.Tests.ps1:64-67 asserts no warning and the Backup state Disabled through Get-Privileges, :74-76 the verbose message, :94 (child script) no warnings for a token that holds only some privileges, :382-387 that no privilege stays enabled after it runs inside a pipeline; OutputTypes.Tests.ps1:95-98 asserts a count above 1 and the type. All skip unless the token holds the privileges. | Partly | ParameterSets.Items.Tests.ps1:451 Disable-Privileges should write Disable Privilege Error with SecurityError and AdjustPriviledgeException and no output when nothing is enabled | the -PassThru object privilege-state values on the successful disable path (still only count/type asserted); the warning when a privilege cannot be disabled | state values on success path: budget; the warning: Limit (needs a race with another command) |
| 65 | items | Get-Privileges | __AllParameterSets | False | 18 | 2 | 0 | 19 | NA | NA | NA | NA | Partly | ObjectApis.Tests.ps1:229 Should compare boxed and typed privilege values consistently without accepting an attributes enum | OutputTypes.Tests.ps1:88 Enable-Privileges should write one object per privilege | Privileges.Tests.ps1:62 Should disable the privileges that Enable-Privileges enabled | PipelineControl.Tests.ps1:164 <Name> should stop after the first object for Select-Object -First 1 and change nothing else | 2: a read helper and the check that the account holds the four file system privileges | The output is never compared with an independent source (whoami /priv or the Win32 token), and no test asserts the objects beyond a count above 0, the Equals contract of the first value and the privilege and state that other cmdlets' tests read back; the Removed state and the PrivilegeAttributes property are unasserted. Errors are NA: the cmdlet has no handler and no designed failure. | TestNeeded | ObjectApis.Tests.ps1:229-233 asserts a count above 0 and the equality contract; OutputTypes.Tests.ps1:88 compares the -PassThru count with the cmdlet itself; Privileges.Tests.ps1:30 (read helper) reads one privilege state for the tests of Enable-Privileges and Disable-Privileges. The other calls are preconditions or read-backs. | Partly | ParameterSets.Items.Tests.ps1:503 Should match whoami /priv for the privileges that whoami and the library name the same way | the Removed PrivilegeState value | budget |