* Review Folder Permissions Plugin Snippet

[tatewise]

I am developing a Plugin script to test the access permission to a Windows folder without altering its Date modified.
The current strategy saves and deletes a temporary file in the folder, but that alters its Date modified.

My strategy uses the PowerShell Get-Acl command to read the Access Control List of the folder.
It should run in all current Windows versions (7, 8.1,10) in both Administrator and Standard accounts.

However, could any of you please check that is the case with the Permissions Plugin attachment three posts later.
It should silently check the current Project Public sub-folder and report FullControl permission as below.
There are similar messages for other cases.
Please tell me what happens and supply your Windows version details and whether Administrator or Standard account.

PermissionsMessageBox.png (8 KiB) Viewed 9793 times

[Ron Melby]

you powered thru it!!!!

I ran it on my profile USR (which has admin priv) and it showed exactly like your screen. (didnt put it up, no sense wasting bytes on ditto)
the folder remains at 5/1/2020 after the check

windows 10 just updated ptfs this morning 64 bits. 6.7.2 fh

[Valkrider]

Mike

As expected no luck with PlayOnMac.

Screenshot 2020-05-14 at 14.14.22.png (55.14 KiB) Viewed 9788 times

And it doesn't like mapped drives in a VM

vm.JPG (30.77 KiB) Viewed 9788 times

VM is Windows 10 Pro 64bit running as admin

[tatewise]

Thank you Ron and Colin.

I didn't expect it to work in POM but the VM should work.
However, the message gives a clue, as on my platform there are three dots after the Allow -1 text.

Please try the attached variant of the Permissions Plugin that hopefully caters for those scenarios.
[ EDIT: Attachment deleted ~ please use the Plugin Attachment in the most recent posting. ]

It seems clear it works for Windows 10 in Administrator accounts, so I am looking for other variants Win 7 or Win 8.1 and Standard User accounts.

[johnmorrisoniom]

I am running W10 Pro OS Build 18363.778 64bit

Project folder is on Dropbox via a mapped drive.

Permissions.JPG (20.47 KiB) Viewed 9768 times

[jbtapscott]

Mike - I received same status as in your original post - viz. FullControl

Running Windows 10 Pro, 64 bit, Build 18363.836. Administrator User Account

[Valkrider]

Mike

A couple of interesting things. The new one failed to install on the VM and overwrite the old version came up with unable to install. I manually deleted the old one and installed the new one fine. Still an issue though.

vm2.jpg (19 KiB) Viewed 9760 times

[tatewise]

@Colin, does that installation problem arise with other Plugins installed over identically named ones?
Please check the POM case again, if you can.
I need to investigate the numerical ACL cases. It is possible that -1 means FullControl.

[Valkrider]

Mike

I have never had that issue before and regularly update plugins manually just by running the new downloaded version. It is the first time that I have ever had this. So ma be JOOTT.

I have just updated POM without issue by installing the new version over the top of the old one. A different error this time but nearly there.

Screenshot 2020-05-14 at 16.20.23.png (43.7 KiB) Viewed 9742 times

[tatewise]

In that POM case, it should also have said No PowerShell Get-Acl log file produced. at the bottom.
The Plugin is now detecting if the PowerShell command actually produces a Get-Acl.log file or not.
BTW: Is there a POM install module option for PowerShell &/or Get-Acl features?

[Ron Melby]

I made a visitor account no admin priv

Full permission

[Ron Melby]

https://theithollow.com/2016/08/22/inst ... shell-mac/

thats what I am led to for powershell PlayOnMac

*edit (I used the wrong link, corrected)

https://docs.microsoft.com/en-us/powershell/

looks like m$ has all the packages for each sys

[laz_gen]

Windows 7 Ultimate - Service Pack 1

FH data in Dropbox folder

[tatewise]

@laz_gen ~ Oh dear, that is a shame!
It is clearly running PowerShell Get-Acl but the log format does not have the Windows 10 format that would end with
Public BUILTIN\Administrators BUILTIN\Administrators Allow FullControl...

I thought it might be caused by FAT disk format instead of NTFS but I tried a FAT USB pen drive and it was OK.

[Ron Melby]

can you -wide 1200 or something precreate the outfile and -append for mor char?
but doesnt ... say there is more?

[tatewise]

Ron, I have checked that Family Historian message box with much, much, much more text than is shown here, and it always shows all of it.

For reasons best known to the Get-Acl command its logged report typically ends with ...
e.g. Public TATE7\Mike NT AUTHORITY\SYSTEM Allow FullControl...
I know that usually means there is more but not in this case it seems.

There was an exception posted by earlier Valkrider that ended Public O:S-1-5-21-501 Everyone Allow -1 without dots.
But there is always the word Allow and then an access name or number.

If you run the Plugin in debug mode on your PC you will see the report log in the strLogText variable.
Or just let it Go and it will print the report log on completion.

[laz_gen]

Mike

Just did a bit of googling on get-acl and found mention of the .access feature.

I followed the example given with c:\windows and it returned an extensive set of results, though I have no idea if it is what you need.

I tried it with the full path to my public folder and the command failed however it does work if the path is included in "".

The command I used...

(Get-Acl "D:\Dropbox\#Genealogy Live\Lasbury_June_2019\Public").Access

The first block of the output is as shown below and there are a further 7 similar blocks presumably for each user.

FileSystemRights : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrators
IsInherited : True
InheritanceFlags : None
PropagationFlags : None

Is this what you need?

[tatewise]

Thank you, that is really useful ~ I had not found that feature.

[Ron Melby]

laz-gen, I tried that too, where did you try that command? mock up in lua?
cuz you cant do it from cmd /c that I can see.

[tatewise]

I've rewritten the Plugin as Attachment with that new information (it has always used CMD /C to run PowerShell).

[ EDIT: Attachment deleted ~ Please use the Plugin Attachment in the latest posting. ]

[Ron Melby]

it gets it and throws it up, minor cavil:

Untitled.png (135.23 KiB) Viewed 9558 times

it says no effective permissions found. as it showed them, might be a logic problem or you just didnt type in a big bunch when you revamped the thing.

but for the BIIIIIIIIIIIG plugin. ....

[laz_gen]

Different output from others but looks like it it is working.

[Valkrider]

Mike

No there are no addons with names like either of those in POM.

I have run the latest version of the plugin in POM

Screenshot 2020-05-15 at 09.45.28.png (63.99 KiB) Viewed 9573 times

And in the VM

vm3.jpg (17.73 KiB) Viewed 9573 times

[laz_gen]

Just looking a bit deeper into my longer negative decimal number of -1610612736 that was output from the plugin.

Converted to hex it has just bits 30 and 31 set to 1 and I found a website that shows the Access_Mask has bit 30 to signify generic write and bit 31 to signify generic read.

So it looks like it is reading mine OK, and just reporting it in an obscure manner.

[tatewise]

@laz_gen ~ Yes, I had found that access mask bit pattern explanation of numbers and will cater for them eventually.

@Ron ~ The script gets the current username DESKTOP VM8CLKV\USR and tries to find the FileSystemRights associated with that IdentityReference but in your case fails for some unknown reason, because that username is listed in the log as shown in your screenshot and should find FullControl.
I ran the Plugin in debug mode with a breakpoint between running PowerShell and opening log file.
I edited the log file with Notepad to replace my username with your username.
I let the plugin run on from the breakpoint and it found FullControl just fine, so have no idea why yours failed.