You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

ClearAudit.cs 3.9 KiB

8 jaren geleden
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118
  1. using Alphaleonis.Win32.Filesystem;
  2. using Security2;
  3. using System;
  4. using System.Management.Automation;
  5. namespace NTFSSecurity
  6. {
  7. [Cmdlet(VerbsCommon.Clear, "NTFSAudit", DefaultParameterSetName = "Path")]
  8. public class ClearAudit : BaseCmdletWithPrivControl
  9. {
  10. private SwitchParameter disableInheritance;
  11. [Parameter(Mandatory = true, Position = 1, ValueFromPipeline = true, ValueFromPipelineByPropertyName = true, ParameterSetName = "Path")]
  12. [ValidateNotNullOrEmpty]
  13. [Alias("FullName")]
  14. public string[] Path
  15. {
  16. get { return paths.ToArray(); }
  17. set
  18. {
  19. paths.Clear();
  20. paths.AddRange(value);
  21. }
  22. }
  23. [Parameter(Mandatory = true, Position = 1, ValueFromPipeline = true, ValueFromPipelineByPropertyName = true, ParameterSetName = "SD")]
  24. [ValidateNotNullOrEmpty]
  25. public FileSystemSecurity2[] SecurityDescriptor
  26. {
  27. get { return securityDescriptors.ToArray(); }
  28. set
  29. {
  30. securityDescriptors.Clear();
  31. securityDescriptors.AddRange(value);
  32. }
  33. }
  34. [Parameter]
  35. public SwitchParameter DisableInheritance
  36. {
  37. get { return disableInheritance; }
  38. set { disableInheritance = value; }
  39. }
  40. protected override void BeginProcessing()
  41. {
  42. base.BeginProcessing();
  43. }
  44. protected override void ProcessRecord()
  45. {
  46. if (ParameterSetName == "Path")
  47. {
  48. FileSystemInfo item = null;
  49. foreach (var path in paths)
  50. {
  51. try
  52. {
  53. item = GetFileSystemInfo2(path);
  54. }
  55. catch (Exception ex)
  56. {
  57. WriteError(new ErrorRecord(ex, "ReadFileError", ErrorCategory.OpenError, path));
  58. continue;
  59. }
  60. try
  61. {
  62. FileSystemAuditRule2.RemoveFileSystemAuditRuleAll(item);
  63. if (disableInheritance)
  64. FileSystemInheritanceInfo.DisableAuditInheritance(item, true);
  65. }
  66. catch (UnauthorizedAccessException)
  67. {
  68. try
  69. {
  70. var ownerInfo = FileSystemOwner.GetOwner(item);
  71. var previousOwner = ownerInfo.Owner;
  72. FileSystemOwner.SetOwner(item, System.Security.Principal.WindowsIdentity.GetCurrent().User);
  73. FileSystemAuditRule2.RemoveFileSystemAuditRuleAll(item);
  74. if (disableInheritance)
  75. FileSystemInheritanceInfo.DisableAuditInheritance(item, true);
  76. FileSystemOwner.SetOwner(item, previousOwner);
  77. }
  78. catch (Exception ex2)
  79. {
  80. WriteError(new ErrorRecord(ex2, "ClearAclError", ErrorCategory.WriteError, path));
  81. }
  82. }
  83. catch (Exception ex)
  84. {
  85. WriteError(new ErrorRecord(ex, "ClearAclError", ErrorCategory.WriteError, path));
  86. }
  87. }
  88. }
  89. else
  90. {
  91. foreach (var sd in securityDescriptors)
  92. {
  93. FileSystemAuditRule2.RemoveFileSystemAuditRuleAll(sd);
  94. if (disableInheritance)
  95. FileSystemInheritanceInfo.DisableAuditInheritance(sd, true);
  96. }
  97. }
  98. }
  99. protected override void EndProcessing()
  100. {
  101. base.EndProcessing();
  102. }
  103. }
  104. }