Re: Setting ACLs from non-domain computer

Hi,

I don't think this will work - to set ACLs, the client must be able to talk
to the DC to resolve SIDs to Names and vice versa - this will only work for
domain members.

Try this

NTAccount acc = new NTAccount("domain\someAccOrGroup");
SecurityIdentifier sid =
(SecurityIdentifier)acc.Translate(typeof(SecurityIdentitfier);

this will most prolly not work (haven't verified it but I am quite sure).

There is not WindowsIdentity for a group, you simply need the SID - the
above code is used by FileSecurity/DirectorySecurity under the covers.

cheers,
dominick

-----------------------------
Dominick Baier, DevelopMentor
http://www.leastprivilege.com


-----Original Message-----
From: Discussion relating to the specifics of the C# and Managed C++
languages [mailto:[email protected]] On Behalf Of Mont Rothstein
Sent: Mittwoch, 6. September 2006 02:12
To: [email protected]
Subject: [DOTNET-CX] Setting ACLs from non-domain computer

I am using System.Security.AccessControl to set ACLs.

I am also using LogonUser() to gain access to a share from a computer that
is not on the domain (using LOGON32_LOGON_NEW_CREDENTIALS).

What I can't figure out is if there is anyway to set ACLs on
directories/files for groups from a non-domain computer.  If I try and
simply pass in "domainname\groupname" to FileSystemAccessRule() I get an
exception when I go to modify the access rule (this works fine from a
computer on the domain).

It seems it might work if I could get a WindowsIdentity for the group, but I
don't know how to do this or even if it can be done (is there such a thing
as a WindowsIdentity for a group?).

Any help or pointers is appreciated.

Thanks,
-Mont

===================================
This list is hosted by DevelopMentorR  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com