Je souhaiterais créer un script Autoit me permettant de partager des dossiers Windows (SMB) et sur lesquels seraient attribués des droits en fonction des utilisateurs/groupes d'un active directory.
J'ai trouvé un script VBA qui à priori ferait tout cela mais je suis coincé sur la ligne SecDesc.Properties_.Item("DACL") = Array(ACE). J'ai essayé en remplaçant Array(ACE) par [$ACE] mais évidemment cela ne fonctionne pas. Le reste semble fonctionner après conversion.
Bon j'ai trouvé la soluce. C'est tout bête.
Il suffit de déclarer un tableau d'une case au préalable et de lui affecter la valeur $ACE. Et c'est ce tableau qui est affecté à $SecDesc.Properties_.Item("DACL").
Script complet permettant de partager un dossier et d'attribuer les droits de partage de l'utilisateur spécifié :
$Foldername="d:\test" ;folder to share
$sharename="Partage de test" ;Share Name
$strDesc="Un petit test réussi." ;Share Description
$strUser="beau" ;User to set permissions for
$objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate,(Security)}!\\.\root\cimv2")
; Connects to the WMI service with security privileges
$SecDescClass = $objWMIService.Get("Win32_SecurityDescriptor")
; Need an instance of the Win32_SecurityDescriptor so we can create an instance of a Security Descriptor.
$SecDesc = $SecDescClass.SpawnInstance_()
; Create an instance of a Security Descriptor.
$colWinAcc = $objWMIService.ExecQuery("SELECT * FROM Win32_ACCOUNT WHERE Name='" & $strUser & "'")
If $colWinAcc.Count < 1 Then
ConsoleWrite("User " & $strUser & "Not Found - quitting"&@cr)
EndIf
; Find the WMI representation of a particular Windows Account
For $refItem in $colWinAcc
$refSID = $objWMIService.Get("Win32_SID='" & $refItem.SID & "'")
; Get the SID for the choosen Windows account.
Next
$refTrustee = $objWMIService.Get("Win32_Trustee").spawnInstance_()
; Creates an instance of a Windows Security Trustee (usually a user but anything with a SID I guess...)
With $refTrustee
.Domain = $refSID.ReferencedDomainName
.Name = $refSID.AccountName
.SID = $refSID.BinaryRepresentation
.SidLength = $refSID.SidLength
.SIDString = $refSID.SID
EndWith
; Sets the trustee object up with the SID & all that malarkey from the user object we have choosen to work on
$ACE = $objWMIService.Get("Win32_Ace").SpawnInstance_
; Creates an instance of an Access Control Entry Object(this will be one entry on the access list on an object)
$ACE.Properties_.Item("AccessMask") = 2032127
; This is full Control
; (bitflag) full list here: http://blogs.msdn.com/b/helloworld/archive/2008/06/10/common-accessmask-value-when-configuring-share-permission-programmatically.aspx
$ACE.Properties_.Item("AceFlags") = 3
; what to apply ACE to inc
; inhehitance 3 - means files & folders get permssions & pass onto children
$ACE.Properties_.Item("AceType") = 0
; 0=allow access 1=deny access
$ACE.Properties_.Item("Trustee") = $refTrustee
; Set the Trustee (user) that this Access control Entry will refer to.
Local $array[1] = [$ACE]
$SecDesc.Properties_.Item("DACL") = $array
; Get the DACL property of the Security Descriptor object
; Add the ACE to the Dynamic Access Control List on the object (an array) it will overwrite the old entries
; unless you retreive & save 'em first & add them to a big array with the new entry as well as the old ones
$Share = $objWMIService.Get("Win32_Share")
; Get a WMI share Object
$InParam = $Share.Methods_("Create").InParameters.SpawnInstance_()
; Create an instance of a WMI input Parameters object
$InParam.Properties_.Item("Access") = $SecDesc
; Set the Access Parameter to the Security Descriptor Object we configured above
$InParam.Properties_.Item("Description") = $strDesc
$InParam.Properties_.Item("Name") = $ShareName
$InParam.Properties_.Item("Path") = $FolderName
$InParam.Properties_.Item("Type") = 0
$outParams=$Share.ExecMethod_("Create", $InParam)
; Create the share with all the parameters we have set up
ConsoleWrite("OUT: " & $outParams.returnValue&@cr)
If $outParams.returnValue <> 0 Then
ConsoleWrite("Failed to Create Share, return Code:" & $outParams.returnValue&@cr)
Else
ConsoleWrite("Folder " & $Foldername & " sucessfully shared as: " & $sharename & " with FULL CONTROL Permissions for user " & $strUser&@cr)
EndIf
Par contre cela n'attribue pas les droits NTFS au dossier de partage.
L'un d'entre vous connait-il un moyen d'y arriver dans le même style ?
