Setting Folder permissions on Vista

问题:

I am trying to set the permissions of a folder and all of it's children on a vista computer. The code I have so far is this.

 public static void SetPermissions(string dir)
        {
            DirectoryInfo info = new DirectoryInfo(dir);
            DirectorySecurity ds = info.GetAccessControl();            
            ds.AddAccessRule(new FileSystemAccessRule(@"BUILTIN\Users", 
                             FileSystemRights.FullControl, 
                             InheritanceFlags.ContainerInherit,
                             PropagationFlags.None, 
                             AccessControlType.Allow));

            info.SetAccessControl(ds);            
        }

However it's not working as I would expect it to.
Even if I run the code as administrator it will not set the permissions.

The folder I am working with is located in C:\ProgramData\<my folder> and I can manually change the rights on it just fine.

Any one want to point me in the right direction.

回答1:

So the answer is two fold. First off a sub folder was being created before the permissions were set on the folder and I needed to or in one more flag on the permissions to make it so both folders and files inherited the permissions.

public static void SetPermissions(string dir)
        {
            DirectoryInfo info = new DirectoryInfo(dir);
            DirectorySecurity ds = info.GetAccessControl();            
            ds.AddAccessRule(new FileSystemAccessRule(@"BUILTIN\Users", 
                             FileSystemRights.FullControl,
                             InheritanceFlags.ObjectInherit |
                             InheritanceFlags.ContainerInherit,
                             PropagationFlags.None,
                             AccessControlType.Allow));
            info.SetAccessControl(ds);            
        }

After that every thing appears to be working.

回答2:

This may be a dumb question, but have you tried performing the same action manually (e.g. using Explorer)? Vista has some directories that not even users in the Administrators group can modify without taking additional steps. I think there are two steps you need to take first.

First, use Explorer to make the same modification you're trying to do in your code. If it fails, troubleshoot that.

Second, test your code on a directory you created under your own user folder. You shouldn't need admin privs to do that; the logged-in account should be able to change ACL on folders under e.g. c:\Users\yourname\documents.

I'd also step through the code in the debugger and look at the "ds" object just before your call to SetAccessControl. That might show you something unexpected to set you on the right path.