Nie możesz wybrać więcej, niż 25 tematów Tematy muszą się zaczynać od litery lub cyfry, mogą zawierać myślniki ('-') i mogą mieć do 35 znaków.

Get-OrphanedAudit.cs 1.8 KiB

8 lat temu
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556
  1. using Alphaleonis.Win32.Filesystem;
  2. using Security2;
  3. using System;
  4. using System.Collections.Generic;
  5. using System.Linq;
  6. using System.Management.Automation;
  7. namespace NTFSSecurity.AuditCmdlets
  8. {
  9. [Cmdlet(VerbsCommon.Get, "NTFSOrphanedAudit")]
  10. [OutputType(typeof(FileSystemAuditRule2))]
  11. public class GetOrphanedAudit : GetAudit
  12. {
  13. int orphanedSidCount = 0;
  14. protected override void ProcessRecord()
  15. {
  16. IEnumerable<FileSystemAuditRule2> acl;
  17. FileSystemInfo item = null;
  18. foreach (var p in paths)
  19. {
  20. try
  21. {
  22. item = this.GetFileSystemInfo2(p);
  23. }
  24. catch (Exception ex)
  25. {
  26. this.WriteError(new ErrorRecord(ex, "ReadError", ErrorCategory.OpenError, p));
  27. continue;
  28. }
  29. try
  30. {
  31. acl = FileSystemAuditRule2.GetFileSystemAuditRules(item, !ExcludeExplicit, !ExcludeInherited, getInheritedFrom);
  32. var orphanedAces = acl.Where(ace => string.IsNullOrEmpty(ace.Account.AccountName));
  33. orphanedSidCount += orphanedAces.Count();
  34. this.WriteVerbose(string.Format("Item {0} knows about {1} orphaned SIDs in its ACL", p, orphanedAces.Count()));
  35. this.WriteObject(orphanedAces);
  36. }
  37. catch (Exception ex)
  38. {
  39. this.WriteWarning(string.Format("Could not read item {0}. The error was: {1}", p, ex.Message));
  40. }
  41. }
  42. }
  43. protected override void EndProcessing()
  44. {
  45. WriteVerbose(string.Format("Total orphaned Access Control Enties: {0}", orphanedSidCount));
  46. base.EndProcessing();
  47. }
  48. }
  49. }