设置ACE慢了许多文件的文件夹(Setting ACE slow for folder with m

我们已经创建了提供了一个windows文件夹设置一个递归“拒绝”一定Active Directory组的能力的应用程序。基本相同，进入的属性在Windows资源管理对话框并点击安全并与拒绝的许可的加入AD组。我们使用此代码：

public void DenyAccessInherited(string DomainAndSamAccountName)
    {
        SetPermissionAndInherit(this.FolderPath, 
            NTFSPermission.PropagationFlags.CONTAINER_AND_OBJECT_INHERIT_ACE,
            NTFSPermission.NTFSPermission_FULL_CONTROL, NTFSPermission.ACETypes.ADS_ACETYPE_ACCESS_DENIED,
            DomainAndSamAccountName);
    }

public static void SetPermissionAndInherit(string FolderPath, PropagationFlags Inheritance, int Permission, ACETypes ACETypeAccessAllowedDenied, string DomainAndUsername)
    {
        AccessControlList dacl = new AccessControlList();
        SecurityDescriptor sd = new SecurityDescriptor();
        AccessControlEntry newAce = new AccessControlEntry();
        ADsSecurityUtility sdUtil = new ADsSecurityUtility();

        OnProgress(DomainAndUsername, FolderPath);
        sd = sdUtil.GetSecurityDescriptor(FolderPath, ADS_PATH_FILE, ADS_SD_FORMAT_IID);
        dacl = sd.DiscretionaryAcl;

        RemoveTrusteeFromDACL(dacl, DomainAndUsername);

        newAce.Trustee = DomainAndUsername;
        newAce.AccessMask = Permission;

        newAce.AceFlags = (int)Inheritance;
        newAce.AceType = (int)ACETypeAccessAllowedDenied;
        dacl.AddAce(newAce);

        sdUtil.SetSecurityDescriptor(FolderPath, ADS_PATH_FILE, sd, ADS_SD_FORMAT_IID);

        foreach (string File in Directory.GetFiles(FolderPath))
        {
            SetACE(File, DomainAndUsername, Permission, PropagationFlags.INHERITED_ACE, ACETypeAccessAllowedDenied);
        }
        foreach (string SubFolderPath in Directory.GetDirectories(FolderPath))
        {
            SetInheritedPermission(SubFolderPath, DomainAndUsername, Permission, ACETypeAccessAllowedDenied);
        }
    }

private static void SetInheritedPermission(string FolderPath, string DomainAndUsername, int PermissionFlags, ACETypes AccessFlags)
    {
        AccessControlList dacl = new AccessControlList();
        SecurityDescriptor sd = new SecurityDescriptor();
        AccessControlEntry newAce = new AccessControlEntry();
        ADsSecurityUtility sdUtil = new ADsSecurityUtility();

        SetACE(FolderPath, DomainAndUsername, PermissionFlags, (PropagationFlags)(PropagationFlags.CONTAINER_AND_OBJECT_INHERIT_ACE | PropagationFlags.INHERITED_ACE), AccessFlags);
        foreach (string File in Directory.GetFiles(FolderPath))
        {
            SetACE(File, DomainAndUsername, PermissionFlags, PropagationFlags.INHERITED_ACE, AccessFlags);
        }
        foreach (string SubFolderPath in Directory.GetDirectories(FolderPath))
        {
            SetInheritedPermission(SubFolderPath, DomainAndUsername, PermissionFlags, AccessFlags);
        }
    }


private static void SetACE(string FileOrFolder, string DomainAndUsername, int PermissionFlags, PropagationFlags InheritanceFlags, ACETypes AccessFlags)
    {
        AccessControlList dacl = new AccessControlList();
        SecurityDescriptor sd = new SecurityDescriptor();
        AccessControlEntry newAce = new AccessControlEntry();
        ADsSecurityUtility sdUtil = new ADsSecurityUtility(); sd = sdUtil.GetSecurityDescriptor(FileOrFolder, ADS_PATH_FILE, ADS_SD_FORMAT_IID);
        sd.Control = sd.Control;
        OnProgress(DomainAndUsername, FileOrFolder);

        dacl = sd.DiscretionaryAcl;
        RemoveTrusteeFromDACL(dacl, DomainAndUsername);

        newAce.Trustee = DomainAndUsername;
        newAce.AccessMask = PermissionFlags;

        newAce.AceFlags = (int)InheritanceFlags;
        newAce.AceType = (int)AccessFlags;
        dacl.AddAce(newAce);

        sdUtil.SetSecurityDescriptor(FileOrFolder, ADS_PATH_FILE, sd, ADS_SD_FORMAT_IID);
    }

现在，我们遇到了与许多HTML文档，约12000文件的大文件夹，上面的方法是很慢的。它需要约7分钟，处理文件的安全性。然而，通过Windows资源管理安全性时/安全性，只需要20秒左右所以必须有某种方式在C＃来优化这个。

编辑：当我离开了递归和只设置SecurityDescriptor顶部的文件夹，没有它下面的文件有拒绝对AD组，只有顶层文件夹。

Answer 1:

我解决了它。我完全倾倒上面的代码去另一种方式：

public override void DenyAccessInherited(string FolderPath,string DomainAndSamAccountName)
    {
        using (Impersonator imp = new Impersonator(this.connection.GetSamAccountName(), this.connection.GetDomain(), this.connection.Password))
        {
            FileSystemAccessRule rule = new FileSystemAccessRule(DomainAndSamAccountName, FileSystemRights.FullControl, InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, System.Security.AccessControl.PropagationFlags.InheritOnly, AccessControlType.Deny);
            DirectoryInfo di = new DirectoryInfo(FolderPath);
            DirectorySecurity security = di.GetAccessControl(AccessControlSections.All);
            bool modified;
            security.ModifyAccessRule(AccessControlModification.Add, rule, out modified);
            if (modified)
                di.SetAccessControl(security);

        }
    }

这是非常轻薄，速度非常快。

Answer 2:

嵌套文件夹和文件应该继承父母的安全设置，所以你不需要递归设定所有。尝试将其设置为仅根文件夹。