Set Auditing on System Files and Folders with PowerShell

It's easy to set auditing on files and folders using GUI. But imagine if you need to perform this operation on hundreds of servers. PowerShell is your friend in this case!
This article discusses specifics of applying auditing changes on system files and folders (e.g.: C:\Windows, C:\windows\system32\winload.exe). Usually local admin has no write access for these files.

Standard approach of using Set-Acl cmdlet is not working with system files or folders. You might get  UnauthorizedAccessException and you'll see an error: "Set-Acl : Attempted to perform an unauthorized operation." This bug has been reported to Microsoft, but still not fixed.
In the meantime for such cases I created the following function:
function Set-AuditFail
# Enable Auditing on the file or folder, with the following specifications. Name: Everyone; Access: Failed for all listed accesses
 {
   param([String]$TargetFolder)
   $ACL = Get-Acl -Path $TargetFolder -Audit
   If (($ACL.AuditToString -eq "Everyone Failure  FullControl") -OR ($ACL.AuditToString -eq "Everyone Failure  DeleteSubdirectoriesAndFiles, Modify, ChangePermissions, TakeOwnership")){
        Return "Audit settings for object $TargetFolder are correct"
    }
    Else{
        Write-Output "Audit settings for object $TargetFolder are wrong. Modifying..."
        $ACL = [IO.File]::GetAccessControl($TargetFolder, "Audit")
        $rule = New-Object System.Security.AccessControl.FileSystemAuditRule("Everyone","Fullcontrol","None","None","Failure")
        $ACL.SetAuditRule($rule)
        [IO.File]::SetAccessControl($TargetFolder, $ACL)
    }
} This function uses direct access to .NET Framework class IO.File and apparently this class doesn't have the mentioned bug.

Disclaimer: All posts and opinions on this site are provided AS IS with no warranties. These are my own personal opinions and do not represent my employer’s view in any way.

Comments

Post a Comment

Popular posts from this blog

How to uninstall a broken software

From time to time you may have problems uninstalling some software from your Windows computer. As a result you cannot uninstall them from "Windows Programs and Features (Add or Remove Programs)" control panel applet. There are many reasons for that - missing .dll file, corrupted installer or a problem with this Installer package. Resolution 1: Try native Microsoft solution for that: http://support.microsoft.com/mats/program_install_and_uninstall What it fixes: Removes bad registry key on 64 bit operating systems. Windows registry keys that control the upgrade (patching) data that become corrupted. Resolves problems that prevent new programs from being installed. Resolves problems that prevent programs from being completely uninstalled and blocking new installations and updates. Use this troubleshooter for an uninstall only if the program fails to uninstall using the windows add/remove programs feature. Resolution2: Try CCleaner http:/
Read more

Xerox 116-324 fault when printing .doc or .pdf containing callibri fonts

Image
Problem : You are unable to print .PDF or .DOCX documents which contain Calibri fonts. The Xerox 7345 or similar model sends 116-324 error code and needs to reboot. Resolution : Update you computer with the latest drivers from Xerox website. If you are on PCL driver - disable the Print Optimization feature in the driver. If you are on the PS driver set the PostScript Output Option to Optimize for Portability. The print file will be larger and printing will take more time. Another PS driver setting may screw up the text in your PowerPoint slides (as shown on the picture below). It is "PostScript Pass-through". If you have printouts like on the picture below, you better enable "PostScript Pass-through" (Printing preferences> Advanced> Driver section. )
Read more

Create Outlook calendar item with Python

I've created this script when I needed to keep track of my street workout performance. I was needed to have a reminder for each day that will tell me how much repetitions I should do today. So this script will create a bunch of Microsoft Outlook appointments in your calendar according to the "table" dictionary. The table is reduced for this example. It is easier to create such table in MS Excel, then convert it to text and paste into your favourite Python IDE. Please note that this code is using PyWin32 library. def addevent(start, subject):     import win32com.client     oOutlook = win32com.client.Dispatch("Outlook.Application")     appointment = oOutlook.CreateItem(1) # 1=outlook appointment item     appointment.Start = start     appointment.Subject = subject     appointment.Duration = 20     appointment.Location = 'Sprortground'     appointment.ReminderSet = True     appointment.ReminderMinutesBeforeStart = 1     appointment.
Read more