{"id":91361,"date":"2015-10-14T07:00:00","date_gmt":"2015-10-14T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/20151014-00\/?p=91361\/"},"modified":"2019-03-13T12:20:35","modified_gmt":"2019-03-13T19:20:35","slug":"20151014-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20151014-00\/?p=91361","title":{"rendered":"The MoveSecurityAttributes policy affects only how Explorer recalculates ACLs when a file is moved; everybody else is on their own"},"content":{"rendered":"

A customer reported that even though they were deploying Move­Security­Attributes<\/code> policy<\/a> to all their machines, it wasn’t working everywhere. “It works fine with the GUI but does not work (i.e., has no effect) when using the Move command at the command prompt.” <\/p>\n

That’s right. <\/p>\n

The Move­Security­Attributes<\/code> policy applies to Explorer’s file copy engine<\/a>, the thing that kicks in when you call SHFile­Operation<\/code> or use the IFile­Operation<\/code> interface. <\/p>\n

The command prompt doesn’t use either of those functions. It just calls the Move­File­Ex<\/code> function directly. And that function doesn’t respect UI policy because it’s not a UI function. <\/p>\n

The KB article does say this when it finishes talking about the default behavior and starts talking about the policy: <\/p>\n

\n

By default… <\/p>\n

You can modify how Windows Explorer<\/u> handles permissions when objects are copied or moved… <\/p>\n<\/blockquote>\n

(Emphasis mine.) <\/p>\n

The article points out that the technique applies only to Windows Explorer. Mind you, it’s not underlined or anything, so somebody in a hurry is like to miss out on that detail. <\/p>\n

So here’s a blog entry to make it more clear. <\/p>\n","protected":false},"excerpt":{"rendered":"

GUI policies tend not to apply to command line tools.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[104],"class_list":["post-91361","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-tipssupport"],"acf":[],"blog_post_summary":"

GUI policies tend not to apply to command line tools.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/91361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=91361"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/91361\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=91361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=91361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=91361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}