Family Historian User Group

I am developing a Plugin script to test the access permission to a Windows folder without altering its Date modified.
The current strategy saves and deletes a temporary file in the folder, but that alters its Date modified.

My strategy uses the PowerShell Get-Acl command to read the Access Control List of the folder.
It should run in all current Windows versions (7, 8.1,10) in both Administrator and Standard accounts.

However, could any of you please check that is the case with the Permissions Plugin attachment three posts later.
It should silently check the current Project Public sub-folder and report FullControl permission as below.
There are similar messages for other cases.
Please tell me what happens and supply your Windows version details and whether Administrator or Standard account.

you powered thru it!!!!

I ran it on my profile USR (which has admin priv) and it showed exactly like your screen. (didnt put it up, no sense wasting bytes on ditto)
the folder remains at 5/1/2020 after the check

windows 10 just updated ptfs this morning 64 bits. 6.7.2 fh

Mike

As expected no luck with PlayOnMac.
And it doesn't like mapped drives in a VM
VM is Windows 10 Pro 64bit running as admin

Thank you Ron and Colin.

I didn't expect it to work in POM but the VM should work.
However, the message gives a clue, as on my platform there are three dots after the Allow -1 text.

Please try the attached variant of the Permissions Plugin that hopefully caters for those scenarios.
[ EDIT: Attachment deleted ~ please use the Plugin Attachment in the most recent posting. ]

It seems clear it works for Windows 10 in Administrator accounts, so I am looking for other variants Win 7 or Win 8.1 and Standard User accounts.

I am running W10 Pro OS Build 18363.778 64bit

Project folder is on Dropbox via a mapped drive.

Mike - I received same status as in your original post - viz. FullControl

Running Windows 10 Pro, 64 bit, Build 18363.836. Administrator User Account

Mike

A couple of interesting things. The new one failed to install on the VM and overwrite the old version came up with unable to install. I manually deleted the old one and installed the new one fine. Still an issue though.

@Colin, does that installation problem arise with other Plugins installed over identically named ones?
Please check the POM case again, if you can.
I need to investigate the numerical ACL cases. It is possible that -1 means FullControl.

Mike

I have never had that issue before and regularly update plugins manually just by running the new downloaded version. It is the first time that I have ever had this. So ma be JOOTT.

I have just updated POM without issue by installing the new version over the top of the old one. A different error this time but nearly there.

In that POM case, it should also have said No PowerShell Get-Acl log file produced. at the bottom.
The Plugin is now detecting if the PowerShell command actually produces a Get-Acl.log file or not.
BTW: Is there a POM install module option for PowerShell &/or Get-Acl features?

I made a visitor account no admin priv

Full permission

https://theithollow.com/2016/08/22/inst ... shell-mac/

thats what I am led to for powershell PlayOnMac

*edit (I used the wrong link, corrected)

https://docs.microsoft.com/en-us/powershell/

looks like m$ has all the packages for each sys

Windows 7 Ultimate - Service Pack 1

FH data in Dropbox folder

@laz_gen ~ Oh dear, that is a shame!
It is clearly running PowerShell Get-Acl but the log format does not have the Windows 10 format that would end with
Public BUILTIN\Administrators BUILTIN\Administrators Allow FullControl...

I thought it might be caused by FAT disk format instead of NTFS but I tried a FAT USB pen drive and it was OK.

can you -wide 1200 or something precreate the outfile and -append for mor char?
but doesnt ... say there is more?

Ron, I have checked that Family Historian message box with much, much, much more text than is shown here, and it always shows all of it.

For reasons best known to the Get-Acl command its logged report typically ends with ...
e.g. Public TATE7\Mike NT AUTHORITY\SYSTEM Allow FullControl...
I know that usually means there is more but not in this case it seems.

There was an exception posted by earlier Valkrider that ended Public O:S-1-5-21-501 Everyone Allow -1 without dots.
But there is always the word Allow and then an access name or number.

If you run the Plugin in debug mode on your PC you will see the report log in the strLogText variable.
Or just let it Go and it will print the report log on completion.

Mike

Just did a bit of googling on get-acl and found mention of the .access feature.

I followed the example given with c:\windows and it returned an extensive set of results, though I have no idea if it is what you need.

I tried it with the full path to my public folder and the command failed however it does work if the path is included in "".

The command I used...

(Get-Acl "D:\Dropbox\#Genealogy Live\Lasbury_June_2019\Public").Access

The first block of the output is as shown below and there are a further 7 similar blocks presumably for each user.

FileSystemRights : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrators
IsInherited : True
InheritanceFlags : None
PropagationFlags : None

Is this what you need?

Thank you, that is really useful ~ I had not found that feature.

laz-gen, I tried that too, where did you try that command? mock up in lua?
cuz you cant do it from cmd /c that I can see.

I've rewritten the Plugin as Attachment with that new information (it has always used CMD /C to run PowerShell).

[ EDIT: Attachment deleted ~ Please use the Plugin Attachment in the latest posting. ]

it gets it and throws it up, minor cavil:
it says no effective permissions found. as it showed them, might be a logic problem or you just didnt type in a big bunch when you revamped the thing.

but for the BIIIIIIIIIIIG plugin. ....

Different output from others but looks like it it is working.

Mike

No there are no addons with names like either of those in POM.

I have run the latest version of the plugin in POM
And in the VM

Just looking a bit deeper into my longer negative decimal number of -1610612736 that was output from the plugin.

Converted to hex it has just bits 30 and 31 set to 1 and I found a website that shows the Access_Mask has bit 30 to signify generic write and bit 31 to signify generic read.

So it looks like it is reading mine OK, and just reporting it in an obscure manner.

@laz_gen ~ Yes, I had found that access mask bit pattern explanation of numbers and will cater for them eventually.

@Ron ~ The script gets the current username DESKTOP VM8CLKV\USR and tries to find the FileSystemRights associated with that IdentityReference but in your case fails for some unknown reason, because that username is listed in the log as shown in your screenshot and should find FullControl.
I ran the Plugin in debug mode with a breakpoint between running PowerShell and opening log file.
I edited the log file with Notepad to replace my username with your username.
I let the plugin run on from the breakpoint and it found FullControl just fine, so have no idea why yours failed.