six demon bag
Wind, fire, all that kind of thing!
Recently I noticed that I was no longer able to delete scheduled tasks on my Windows 7 test box, even though I created them myself. Deletion attempts failed with the following error:
The user account does not have permission to delete this task.
Deleting my own tasks works fine in a vanilla install of Windows 7 SP1, so the issue must have been introduced by some update along the way. I had to modify the permissions on
C:\Windows\System32\Tasks to get it to work again:
icacls "C:\Windows\System32\Tasks" /grant "Authenticated Users":(RD)
Granting "list folder/read data" on the folder itself was sufficient, since the task files are owned by the user creating them and the
CREATOR OWNER principal has full access to subfolders and files.
Posted 19:51 [permalink]
Recently I had the need to compare the ACLs of two Active
Directory objects. With file ACLs I could expand their
properties and compare the resulting lists with
Compare-Object. However, for
ACLs of Active Directory objects that didn't work, so I came up with
the following function.
Posted 18:50 [permalink]
Share migration is a common (if not integral) part of a file server migration. If you just move the shares from one host to another host the process is pretty straightforward as described in MSKB article 125996:
[HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares]on the old file server to a file:
reg export HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares shares.reg
Copy the file to the new file server and import it:
reg import shares.reg
net stop server && net start server
Posted 21:09 [permalink]
A great deal of Windows software requires to be run with administrative or at least power user privileges for no good reason. That's a Bad Thing™, because it enables any user to compromise the system. Most of this software can, however, be talked into running with a normal user's privileges. The problem is usually that the program attempts to write temporary data, configuration data and other stuff like that to places a normal user can't write to. In this article I will describe the procedure I usually apply when having to deal with reluctant software.
Posted 11:27 [permalink]