![\"Bookmark](\"http:\/\/s7.addthis.com\/static\/btn\/v2\/lg-share-en.gif\")
\n <\/p>\n\n <\/p>\n
Microsoft Scripting Guy Ed Wilson here. I was sitting in the kitchen waiting for my pot of English Breakfast tea to steep when my mind began to wander back over the week that was nearly completed. One of these days I will write a script to count the number of words in all the documents in a folder. That suggestion is actually up on the white board in my office, but that day will not be today. What would be cool would be to write a script that uses the Twitter API and determines how many tweets I send in a week. But again that will not be happening today. Then it dawned on me—a question I was asked earlier in the week about using the Get-ACL<\/b> cmdlet to show inherited permissions on registry keys. <\/p>\n
To play around with this just a bit, I need to give a user specific permission to a registry key. This is shown in the following image where you can see I gave Teresa (the Scripting Wife) special permission. <\/p>\n
![\"Image](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/qanda\/hsg\/2010\/may\/hey0523\/wes-05-23-10-01.jpg\" "\\"Image")
<\/p>\n
The actual permission page is shown in the following image, where the Scripting Wife is granted the query value permission. <\/p>\n
![\"Image](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/qanda\/hsg\/2010\/may\/hey0523\/wes-05-23-10-02.jpg\" "\\"Image")
<\/p>\n
The permissions summary page tells me that this value is not inherited. This is seen in the following image.<\/p>\n
![\"Image](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/qanda\/hsg\/2010\/may\/hey0523\/wes-05-23-10-03.jpg\" "\\"Image")
<\/p>\n
If I use the Get-ACL<\/b> cmdlet to retrieve access control lists from a registry key, the default view is not very helpful. This is shown here:<\/p>\n
PS C:> Get-Acl -Path HKCU:SoftwareScriptingGuys<\/p>\n Path <\/span>Owner <\/span>Access PS C:><\/p>\n <\/span><\/span><\/p>\n On the other hand, if I pipe the results of this command to the Format-List<\/b> cmdlet and choose all of the properties, the display is a bit better. This is shown here where I use the fl<\/b> alias instead of typing Format-List<\/b>. <\/p>\n PS C:> Get-Acl -Path HKCU:SoftwareScriptingGuys | fl *<\/p>\n PSPath <\/span>: Microsoft.PowerShell.CoreRegistry::HKEY_CURRENT_USERSoftwareScriptingGuys <\/span><\/span><\/p>\n <\/span><\/p>\n PS C:> (Get-Acl -Path HKCU:SoftwareScriptingGuys).AccessToString <\/span><\/span><\/p>\n One of the really cool things about Windows PowerShell is its support for the .NET Framework. The Format-List<\/b> output from Get-ACL<\/b> told me that the Access<\/b> property that is returned is a series of System.Security.AccessControl.RegistryAccessRule<\/b> .NET Framework classes. When I looked up System.Security.AccessControl.RegistryAccessRule<\/b> on MSDN<\/span><\/a>, I found it returns a number of very helpful properties. Because there are several instances of the Access<\/b> property returned for this particular registry key, I need to use the Foreach-Object<\/b> cmdlet to display the RegistryAccessRule<\/b> for each entry on the key. This is shown here where I use the %<\/b> symbol for an alias for Foreach-Object<\/b>. <\/p>\n PS C:> Get-Acl -Path HKCU:SoftwareScriptingGuys | % { $_.access }<\/p>\n RegistryRights <\/span>: QueryValues RegistryRights <\/span>: FullControl RegistryRights <\/span>: FullControl RegistryRights <\/span>: FullControl RegistryRights <\/span>: ReadKey <\/span><\/span><\/p>\n <\/p>\n Pretty cool, huh? It all revolves around being willing to explore the .NET Framework classes. Luckily, they are all documented on MSDN. I hope you enjoy the rest of your weekend. <\/p>\n <\/p>\n If you want to know exactly what we will be looking at tomorrow, follow us on Twitter<\/a> or Facebook<\/a>. If you have any questions, send e-mail to us at scripter@microsoft.com<\/span><\/a> or post your questions on the Official Scripting Guys Forum<\/span><\/a>. See you tomorrow. Until then, peace. <\/span>\nEd Wilson and Craig Liebendorfer, Scripting Guys<\/span><\/b><\/p>\n <\/span><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":" Microsoft Scripting Guy Ed Wilson here. I was sitting in the kitchen waiting for my pot of English Breakfast tea to steep when my mind began to wander back over the week that was nearly completed. One of these days I will write a script to count the number of words in all the […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[62,31,26,3,63,61,45],"class_list":["post-49653","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-dacls-and-sacls","tag-operating-system","tag-registry","tag-scripting-guy","tag-security","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":" Microsoft Scripting Guy Ed Wilson here. I was sitting in the kitchen waiting for my pot of English Breakfast tea to steep when my mind began to wander back over the week that was nearly completed. One of these days I will write a script to count the number of words in all the […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/49653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=49653"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/49653\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=49653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=49653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=49653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
—- <\/span>—– <\/span>——
Microsoft.PowerShell.CoreRegistry::… NWTRADERSed <\/span>NWTRADERSTeresa Allow <\/span>QueryValues…<\/p>\n
PSParentPath <\/span>: Microsoft.PowerShell.CoreRegistry::HKEY_CURRENT_USERSoftware
PSChildName <\/span>: ScriptingGuys
PSDrive <\/span>: HKCU
PSProvider <\/span>: Microsoft.PowerShell.CoreRegistry
AccessToString <\/span>: NWTRADERSTeresa Allow <\/span>QueryValues
<\/span>NWTRADERSed Allow <\/span>FullControl
<\/span>NT AUTHORITYSYSTEM Allow <\/span>FullControl
<\/span>BUILTINAdministrators Allow <\/span>FullControl
<\/span>NT AUTHORITYRESTRICTED Allow <\/span>ReadKey
AuditToString <\/span>:
Path <\/span>: Microsoft.PowerShell.CoreRegistry::HKEY_CURRENT_USERSoftwareScriptingGuys
Owner <\/span>: NWTRADERSed
Group <\/span>: NWTRADERSDomain Users
Access <\/span>: {System.Security.AccessControl.RegistryAccessRule, System.Security.AccessControl.RegistryAccessRule, System.Security.AccessControl.RegistryAccessRule, System.Security.AccessControl.
RegistryAccessRule…}
Sddl <\/span>: O:S-1-5-21-3746122405-834892460-3960030898-1115G:DUD:AI(A;CI;CC;;;S-1-5-21-3746122405-8348924
<\/span>60-3960030898-1207)(A;OICIID;KA;;;S-1-5-21-3746122405-834892460-3960030898-1115)(A;OICIID;KA;
<\/span>;;SY)(A;OICIID;KA;;;BA)(A;OICIID;KR;;;RC)
AccessRightType <\/span>: System.Security.AccessControl.RegistryRights
AccessRuleType <\/span>: System.Security.AccessControl.RegistryAccessRule
AuditRuleType <\/span>: System.Security.AccessControl.RegistryAuditRule
AreAccessRulesProtected : False
AreAuditRulesProtected <\/span>: False
AreAccessRulesCanonical : True
AreAuditRulesCanonical <\/span>: True<\/p>\n
A careful examination of the output above does not tell me where Teresa received her QueryValues<\/b> permission. The AccessToString<\/b> property gives me both inherited and non-inherited permissions, but it does not tell me where they came from. If this is all I need, I can use this syntax to receive better output.<\/p>\n
NWTRADERSTeresa Allow <\/span>QueryValues
NWTRADERSed Allow <\/span>FullControl
NT AUTHORITYSYSTEM Allow <\/span>FullControl
BUILTINAdministrators Allow <\/span>FullControl
NT AUTHORITYRESTRICTED Allow <\/span>ReadKey<\/p>\n
AccessControlType : Allow
IdentityReference : NWTRADERSTeresa
IsInherited <\/span>: False
InheritanceFlags <\/span>: ContainerInherit
PropagationFlags <\/span>: None<\/p>\n
AccessControlType : Allow
IdentityReference : NWTRADERSed
IsInherited <\/span>: True
InheritanceFlags <\/span>: ContainerInherit, ObjectInherit
PropagationFlags <\/span>: None<\/p>\n
AccessControlType : Allow
IdentityReference : NT AUTHORITYSYSTEM
IsInherited <\/span>: True
InheritanceFlags <\/span>: ContainerInherit, ObjectInherit
PropagationFlags <\/span>: None<\/p>\n
AccessControlType : Allow
IdentityReference : BUILTINAdministrators
IsInherited <\/span>: True
InheritanceFlags <\/span>: ContainerInherit, ObjectInherit
PropagationFlags <\/span>: None<\/p>\n
AccessControlType : Allow
IdentityReference : NT AUTHORITYRESTRICTED
IsInherited <\/span>: True
InheritanceFlags <\/span>: ContainerInherit, ObjectInherit
PropagationFlags <\/span>: None<\/p>\n
<\/p>\n