D
Doug Taylor
Hi,
I originally posted this in dotnet.security, but have moved it here by request:
Hi,
I am trying to programmatically add a user with read permissions to
the DACL of a registry key. All appears to go well until I try to
save the security descriptor back into the registry. I then get the
UnauthorizedAccessException thrown.
I'm doing this with an account that is in the Administrators group.
Any ideas what I am missing?
Code follows:
using System;
using System.Security.Permissions;
using Microsoft.Win32;
using System.Diagnostics;
using ActiveDs;
namespace TRISClientPreSetup
{
class cMain
{
[STAThread]
static void Main(string[] args)
{
RegistryKey oRootKey = Registry.LocalMachine;
AccessControlEntryClass oACE;
ADsSecurityUtilityClass oADSUC = new ADsSecurityUtilityClass();
SecurityDescriptor oSD;
AccessControlList oACL;
try
{
// Set the SecurtityMask of the Security Utility Class object
oADSUC.SecurityMask =
(int)ADS_SECURITY_INFO_ENUM.ADS_SECURITY_INFO_DACL;
// Get the SecurityDescriptor of the of the registry key
oSD = (SecurityDescriptor)oADSUC.GetSecurityDescriptor(
@"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog",
(int)ADS_PATHTYPE_ENUM.ADS_PATH_REGISTRY,
(int)ADS_SD_FORMAT_ENUM.ADS_SD_FORMAT_IID);
// Get the DACL of the SecurityDescriptor of the registry key
oACL = (AccessControlList)oSD.DiscretionaryAcl;
// Set up a new AccessControlEntry to add to the DACL
oACE = new AccessControlEntryClass();
// Set the trustee to the new user
oACE.Trustee = @"KA2G2P51\tris";
// I empirically derrived the AccessMask by manually adding
// this user through regedt32 then examining the value of
// the resulting entry
oACE.AccessMask = (int)(ADS_RIGHTS_ENUM.ADS_RIGHT_READ_CONTROL
| ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CREATE_CHILD
| ADS_RIGHTS_ENUM.ADS_RIGHT_DS_READ_PROP
| ADS_RIGHTS_ENUM.ADS_RIGHT_DS_SELF);
// I derrived the AceFlags the same way
oACE.AceFlags = (int)ADS_ACEFLAG_ENUM.ADS_ACEFLAG_INHERIT_ACE;
// Add the AccessControlEntry to the DACL
oACL.AddAce( oACE );
// Save the DACL back into the SecurityDescriptor
oSD.DiscretionaryAcl = oACL;
// Save the SecurityDescriptor back into the registry
oADSUC.SetSecurityDescriptor(
@"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog",
(int)ADS_PATHTYPE_ENUM.ADS_PATH_REGISTRY,
oSD,
(int)ADS_SD_FORMAT_ENUM.ADS_SD_FORMAT_IID);
// This last line is the line that errors with:
// System.UnauthorizedAccessException: Access is denied.
}
catch ( Exception ex )
{
Console.WriteLine( ex.ToString() );
Console.Read();
}
}
}
}
I originally posted this in dotnet.security, but have moved it here by request:
Hi,
I am trying to programmatically add a user with read permissions to
the DACL of a registry key. All appears to go well until I try to
save the security descriptor back into the registry. I then get the
UnauthorizedAccessException thrown.
I'm doing this with an account that is in the Administrators group.
Any ideas what I am missing?
Code follows:
using System;
using System.Security.Permissions;
using Microsoft.Win32;
using System.Diagnostics;
using ActiveDs;
namespace TRISClientPreSetup
{
class cMain
{
[STAThread]
static void Main(string[] args)
{
RegistryKey oRootKey = Registry.LocalMachine;
AccessControlEntryClass oACE;
ADsSecurityUtilityClass oADSUC = new ADsSecurityUtilityClass();
SecurityDescriptor oSD;
AccessControlList oACL;
try
{
// Set the SecurtityMask of the Security Utility Class object
oADSUC.SecurityMask =
(int)ADS_SECURITY_INFO_ENUM.ADS_SECURITY_INFO_DACL;
// Get the SecurityDescriptor of the of the registry key
oSD = (SecurityDescriptor)oADSUC.GetSecurityDescriptor(
@"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog",
(int)ADS_PATHTYPE_ENUM.ADS_PATH_REGISTRY,
(int)ADS_SD_FORMAT_ENUM.ADS_SD_FORMAT_IID);
// Get the DACL of the SecurityDescriptor of the registry key
oACL = (AccessControlList)oSD.DiscretionaryAcl;
// Set up a new AccessControlEntry to add to the DACL
oACE = new AccessControlEntryClass();
// Set the trustee to the new user
oACE.Trustee = @"KA2G2P51\tris";
// I empirically derrived the AccessMask by manually adding
// this user through regedt32 then examining the value of
// the resulting entry
oACE.AccessMask = (int)(ADS_RIGHTS_ENUM.ADS_RIGHT_READ_CONTROL
| ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CREATE_CHILD
| ADS_RIGHTS_ENUM.ADS_RIGHT_DS_READ_PROP
| ADS_RIGHTS_ENUM.ADS_RIGHT_DS_SELF);
// I derrived the AceFlags the same way
oACE.AceFlags = (int)ADS_ACEFLAG_ENUM.ADS_ACEFLAG_INHERIT_ACE;
// Add the AccessControlEntry to the DACL
oACL.AddAce( oACE );
// Save the DACL back into the SecurityDescriptor
oSD.DiscretionaryAcl = oACL;
// Save the SecurityDescriptor back into the registry
oADSUC.SetSecurityDescriptor(
@"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog",
(int)ADS_PATHTYPE_ENUM.ADS_PATH_REGISTRY,
oSD,
(int)ADS_SD_FORMAT_ENUM.ADS_SD_FORMAT_IID);
// This last line is the line that errors with:
// System.UnauthorizedAccessException: Access is denied.
}
catch ( Exception ex )
{
Console.WriteLine( ex.ToString() );
Console.Read();
}
}
}
}