wmi SetSecurityDescriptor

Question

尝试使用sddl通过wmi授予对systemroot的访问权限，但获得无效参数的错误。这是我的职责：

function GrantSysRoot
{
    Param (
        [string]$strcomputer
    )  
    $sec =  Get-WmiObject -Class Win32_LogicalFileSecuritySetting -Filter "Path='C:\\Windows'" -ComputerName $strcomputer
    $converter = New-Object System.Management.ManagementClass Win32_SecurityDescriptorHelper
    $sddl = $converter.Win32SDToSDDL($sec.GetSecurityDescriptor().Descriptor)
    $newSDDL = $sddl.SDDL += "(" + $SRSDDL + ")"
    $Win32descriptor = $converter.SDDLToWin32SD($newSDDL)
    $result = $sec.SetSecurityDescriptor($Win32descriptor)

    if ($result.ReturnValue -eq 0) {
        LogWrite "Success SystemRoot setting rights"
    } 
    else {
        LogWrite "An error occured with SystemRoot rights settings"
    }
}

SetSecurityDescriptor方法返回无效的参数错误。有什么想法吗？

Answer 1

解决后，我们必须使用属性“描述符”。

$result = $sec.SetSecurityDescriptor($Win32descriptor.Descriptor)

Answer 2

我觉得你做了个小错误。在您的代码中，我无法看到用$SRSDDL定义的任何内容，但是您正在追加数据并以$newSDDL存储。你能再确认一下吗。

function GrantSysRoot
{
Param (
[string]$strcomputer
 )  
 $sec =  Get-WmiObject -Class Win32_LogicalFileSecuritySetting -Filter "Path='C:\\Windows'" -ComputerName $strcomputer
 $converter = new-object system.management.ManagementClass Win32_SecurityDescriptorHelper
 $sddl = $converter.Win32SDToSDDL($sec.GetSecurityDescriptor().Descriptor)
 $newSDDL = $sddl.SDDL += "(" + $SDDL + ")"
 $Win32descriptor = $converter.SDDLToWin32SD($newSDDL)
 $result = $sec.SetSecurityDescriptor($Win32descriptor)
 if ($result.ReturnValue -eq 0){LogWrite "Success SystemRoot setting rights"
    } else {LogWrite "An error occured with SystemRoot rights settings"}