microsoft/smbsecurity

The SMBSecurity module can read and modify the SMB Server Security Descriptors. The functionality is like the old XP PowerToys TweakUI tool, set LanMan Server Admin DACLs feature but updated and command line based.

⚠️ WARNING
This module is currently in development and is considered pre-release software. Please use with caution!

Project

This repo has been populated by an initial template to help get you started. Please make sure to update the content to build a great experience for community-building.

As the maintainer of this project, please make a few updates:

• Improving this README.MD file to provide a great experience
• Updating SUPPORT.MD with content about this project's support experience
• Understanding the security reporting process in SECURITY.MD
• Remove this section from the README

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

smbsecurity's Issues

Save-SMBSecurity errors no matter what passed

Repro:

Save-SMBSecurity
InvalidOperation: You cannot call a method on a null-valued expression.

Save-SMBSecurity: Failed to backup: Backup-SMBSecurity - Failed to backup the SrvsvcConfigInfo SecurityDescriptor: The filename, directory name, or volume label syntax is incorrect. : 'C:\Users\nedpyle\AppData\Local\SMBSecurity\Backup-SrvsvcConfigInfo_SrvsvcConnection_SrvsvcFile_SrvsvcServerDiskEnum_SrvsvcSessionInfo_SrvsvcShareAdminConnect_SrvsvcShareAdminInfo_SrvsvcShareChange_SrvsvcShareConnect_SrvsvcShareFileInfo_SrvsvcSharePrintInfo_SrvsvcStatisticsInfo_SrvsvcTransportEnum_SrvsvcDefaultShareInfo-SMBSec-22082022-1119384208.xml'

====

Save-SMBSecurity -SecurityDescriptor SrvsvcShareFileInfo
Save-SMBSecurity: Failed to backup: Backup-SMBSecurity - Failed to backup the SrvsvcConfigInfo SecurityDescriptor: The filename, directory name, or volume label syntax is incorrect. : 'C:\Users\nedpyle\AppData\Local\SMBSecurity\Backup-SrvsvcConfigInfo_SrvsvcConnection_SrvsvcFile_SrvsvcServerDiskEnum_SrvsvcSessionInfo_SrvsvcShareAdminConnect_SrvsvcShareAdminInfo_SrvsvcShareChange_SrvsvcShareConnect_SrvsvcShareFileInfo_SrvsvcSharePrintInfo_SrvsvcStatisticsInfo_SrvsvcTransportEnum_SrvsvcDefaultShareInfo-SMBSec-22082022-1122476715.xml'

====

I've not found a way to make this cmdlet work.

Backup-SMBSecurity error when not providing a specific descriptor

Repro:

Backup-SMBSecurity

Backup-SMBSecurity: Backup-SMBSecurity - Failed to backup the SrvsvcConfigInfo SecurityDescriptor: The filename, directory name, or volume label syntax is incorrect. : 'C:\Users\nedpyle\AppData\Local\SMBSecurity\Backup-SrvsvcConfigInfo_SrvsvcConnection_SrvsvcFile_SrvsvcServerDiskEnum_SrvsvcSessionInfo_SrvsvcShareAdminConnect_SrvsvcShareAdminInfo_SrvsvcShareChange_SrvsvcShareConnect_SrvsvcShareFileInfo_SrvsvcSharePrintInfo_SrvsvcStatisticsInfo_SrvsvcTransportEnum_SrvsvcDefaultShareInfo-SMBSec-22082022-1112468348.xml'

======

If I provide any descriptor name it works fine. Working repro:

Backup-SMBSecurity -SecurityDescriptor SrvsvcConfigInfo
true

====

I am using PowerShell ver:

winget search Microsoft.PowerShell
Name Id Version Source

PowerShell Microsoft.PowerShell 7.2.6.0 winget

Save-SMBSecurity specify paths?

The Save-SMBSecurity cmdlet doesn't have a path output parameter like the Backup-SMBSecurity cmdlet. It always tries to write to a very deep %appdata% xml file path in my attempts.