No navigation frame on the left?  Click here.

DumpACL: More ACLs

Are you looking for a commercial product called DumpACL, written by Frank Ramos and distributed by Somarsoft? If so, note that this product is now distributed under the name of DumpSec by Systemtools.com and that it is no longer updated, from what I can see. I don't pretend to understand why Frank just up and quit, but the fact remains that my dumpacl is a sample intended to demonstrate a point to other developers, and not a useful administrative utility producing condensed reports on your file system or user database. I am sorry, but there is nothing I can do.

13 Nov 99: Are you interested in security descriptors and their parts? If yes, you might find the fksec classes to your liking.

Dumpacl is what I intend to be the successor to checkacl, and should be useful as both a sample and a utility. The actual routines that dump a complete SECURITY_DESCRIPTOR are contained in dumpacl.cpp (short documentation in dumpacl.h) and might come in handy on their own; main.cpp is just concerned with getting SDs to feed to those routines.

Dumpacl currently retrieves SDs from file system objects, registry keys, and shares only. If you give dumpacl an argument of the form \\foo\bar, it will be interpreted as a sharename (and its SD will be retrieved through NetShareGetInfo() at level 502); otherwise, GetFileSecurity() will be called on the argument. If an argument starts with HKLM, HKU, HKCU, or HKCR, dumpacl will try to open it as a registry path.

New and improved: Mark J. Hogan of System Management Technologies pointed out that getting the SACL off a registry key would always fail, as I didn't ask for ACCESS_SYSTEM_SECURITY when calling RegOpenKeyEx(). This has now changed. Thanks, Mark!

Do note that the code uses not a single new-style API (the ones introduced with NT4), as all the caveats listed on the checkacl page still hold true -- the new APIs will clear the permissions bits, and they will clear any bits they aren't aware of (including the all-important ACCESS_SYSTEM_SECURITY bit) from any permissions mask they encounter.

I built this sample on NT5; I think I eliminated all NT5 dependencies, and I hope you will let me know if I missed any. My email address is in the footer, or use the feedback page. Anyway, to compile the sample, download all of the files below into a single directory (or grab dumpacl.zip), use msdev.exe to load dumpacl.dsp, and there you go!

dumpacl.dsp, 4 KB: project file for VC++ 6.0 (SP4)
std.cpp, 1 KB: std.cpp and std.h take care of the precompiled header
std.h, 1 KB
main.cpp, 11 KB: impersonates another user if desired, gets the SECURITY_DESCRIPTOR off the items on the command line
dumpacl.h, 2 KB: contains prototypes and minimal documentation for dumpacl.cpp
dumpacl.cpp, 15 KB: and finally, here is the meat of the sample. Enjoy!