Return to readme.txt CVS log

Up to [WindowsNT SDKs] / q_a / samples / check_sd

Annotation of q_a/samples/check_sd/readme.txt, revision 1.1

1.1     ! root        1: Sample: Demonstration of Code to Examine SD's (Security Descriptors)
        !             2: 
        !             3: Summary:  In the Win32 .hlp file, if you click on Search, goto
        !             4:   "Security Overview", then choose from the list of topics under
        !             5:   Security Overview the sub-topic "Allowing Access", you'll find
        !             6:   the comment
        !             7: 
        !             8:     Note:  It is fine to write code like this that builds security
        !             9:       descriptors from scratch.  It is, however, a good practice
        !            10:       for people who write code that builds or manipulates
        !            11:       security descriptors to first write code that explores the
        !            12:       default security descriptors that Windows NT places on
        !            13:       objects.  For example, if Windows NT by default includes in
        !            14:       a DACL an ACE granting the Local Logon SID certain access,
        !            15:       it's good to know that, so that a decision not to grant any
        !            16:       access to the Local Logon SID would be a conscious decision
        !            17: 
        !            18: Purpose of this sample:  The comment in the .hlp file is accurate,
        !            19:   however, for many people this task of examining the SD is easier
        !            20:   if there is sample code to start from.  So, the purpose of this
        !            21:   sample is to assist people by providing sample code people can
        !            22:   start from as they examine SD(s).  This sample as is examines
        !            23:   the SD on files, and this code can be modified to examine the SD
        !            24:   on other objects
        !            25: 
        !            26:   This sample is not a supported utility
        !            27: 
        !            28: To run:  Type Check_sd to check the SD on the \\.\A:  device
        !            29: 
        !            30:          Type Check_sd d:\a.fil to check the SD on the d:\a.fil
        !            31:            file.  In this case d: must be formatted NTFS,
        !            32:            because only NTFS files have SD(s)
        !            33: 
        !            34: Further notes:
        !            35: 
        !            36: - If you recompile with this define set like this
        !            37: 
        !            38:   #define I_DO_NOT_WANT_THIS_CODE_TO_CLUTTER_THIS_PROGRAM_S_OUTPUT (1==0)
        !            39: 
        !            40:     and re-run the program, the program will produce a lot more
        !            41:       output, including displaying all the info you can access in
        !            42:       a Win32 program from the process's Access Token, and the
        !            43:       SD's of some sample objects
        !            44: 
        !            45:   - If you logon, run with the program built to produce the extra
        !            46:     output as mentioned just above, save that output to a file,
        !            47:     then log off and re-run the program, save the output of this
        !            48:     second run to a different file, you can with WinDiff easily
        !            49:     observe how the local logon SID really does change values for
        !            50:     each logged on session
        !            51: 
        !            52: - A sample test you could run to exercise DACLs involves using the
        !            53:   \q_a\samples\sd_flppy sample in conjunction with this check_sd
        !            54:   sample
        !            55: 
        !            56:   - Log on to a machine as a local Administrator
        !            57:   - Do
        !            58:     check_sd \\.\A: >out_bef.a
        !            59:     check_sd \\.\B: >out_bef.b
        !            60:   - Logoff
        !            61:   - Log on the same machine as Guest on the local machine domain
        !            62:   - Do
        !            63:     sd_flppy
        !            64:   - Try
        !            65:     dir a:    (observe access denied)
        !            66:     dir b:    (observe access denied)
        !            67:     copy config.sys a:\   (get device not found)
        !            68:     copy config.sys b:\   (get device not found)
        !            69:   - Logoff
        !            70:   - Log on the same machine as a local Administrator
        !            71:   - Do
        !            72:     check_sd \\.\A: >out_aft.a
        !            73:     check_sd \\.\B: >out_aft.b
        !            74:   - Browse the differences between out_bef.* and out_aft.*
        !            75: 
        !            76: - The above sample test demonstrates that the ACLs that sd_flppy
        !            77:   applies survive logoffs.  To demonstrate the DACLs do not
        !            78:   survive rebooting, simply reboot, log back on as a local
        !            79:   Administrator, and
        !            80:     check_sd \\.\A: >out_rbt.a
        !            81:     check_sd \\.\B: >out_rbt.b
        !            82:   to see the DACLs are again as they were in
        !            83:                      out_bef.a
        !            84:                      out_bef.b

This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.