I have a script that enables sharing on a folder an sets the sharing permissions. The script works fine with one exception which is the most important one if you wanna generate a HomeUse-Directory. I can't set the sharing permissions for the group "Everyone" with the error message:
The account "Everyone" couldn't be mapped to a SID
So I did some research and found this very interesting article which says that the group "Everyone" didn't have a SID until Windows Vista/Server 2008.
After some more reading I found another article called "Well-known SIDs". Now I had the SID for the World/Everyone group as those groups are not listed in the AD. So I changed my script to search for the SID directly instead of using the pre-Windows 2000 parameter. Sadly this didn't work either.
And there I am now, pretty clueless. I guess there are some work-arounds but I actually like to do it with the group "Everyone".
As far as I know "Everyone" is a non-AD-based group like the "local Admin" and "System". Strangly I can set the sharing permissions for "System", but not for "Everyone/World/SELF"
Do I miss something?
I'm glad to hear any experience you guys had with this matter.
Edit:
As requested - here the code which gives me the error:
Dim SetEntriesResult As UInteger = SetEntriesInAcl(1, ExplicitAccessRule(i), AclPtr, AclPtr)
'Check the result of the SetEntriesInAcl API call
If SetEntriesResult = ERROR_NONE_MAPPED Then
Throw New ApplicationException("The account " & FullAccountName & " could not be mapped to a security identifier (SID).")
ElseIf SetEntriesResult <> 0 Then
Throw New ApplicationException("The account " & FullAccountName & " could not be added to the ACL as the follow error was encountered: " & SetEntriesResult & ".")
End If
So its the ERROR_NONE_MAPPED
- API Error
Relevant code used above:
<DllImportAttribute("advapi32.dll", EntryPoint:="SetEntriesInAclW")> _
Private Shared Function SetEntriesInAcl(ByVal cCountOfExplicitEntries As Integer, <InAttribute()> ByRef pListOfExplicitEntries As EXPLICIT_ACCESS, <InAttribute()> ByVal OldAcl As System.IntPtr, ByRef NewAcl As System.IntPtr) As UInteger
End Function
Public Shared Function ShareExistingFolder(ByVal ShareName As String, ByVal ShareComment As String, ByVal LocalPath As String, ByVal SharePermissions As List(Of SharePermissionEntry), Optional ByVal ComputerName As String = Nothing) As NET_API_STATUS
'Argument validation
If String.IsNullOrEmpty(ShareName) OrElse String.IsNullOrEmpty(LocalPath) OrElse SharePermissions Is Nothing OrElse SharePermissions.Count = 0 Then
Throw New ArgumentException("Invalid argument specified - ShareName, LocalPath and SharePermissions arguments must not be empty")
End If
'Create array of explicit access rules, one for each user specified in the SharePermissions argument
Dim ExplicitAccessRule(SharePermissions.Count - 1) As EXPLICIT_ACCESS
'This pointer will hold the full ACL (access control list) once the loop below has completed
Dim AclPtr As IntPtr
'Loop through each entry in our list of explicit access rules, build each one and add it to the ACL
For i As Integer = 0 To ExplicitAccessRule.Length - 1
'Build the user or group name
Dim FullAccountName As String = String.Empty
If Not String.IsNullOrEmpty(SharePermissions(i).DomainName) Then
FullAccountName = SharePermissions(i).DomainName & "\"
End If
FullAccountName &= SharePermissions(i).UserOrGroupName
'Create a TRUSTEE structure and populate it with the user account details
Dim Account As New TRUSTEE
With Account
.MultipleTrusteeOperation = MULTIPLE_TRUSTEE_OPERATION.NO_MULTIPLE_TRUSTEE
.pMultipleTrustee = 0
.TrusteeForm = TRUSTEE_FORM.TRUSTEE_IS_NAME
.ptstrName = FullAccountName
.TrusteeType = TRUSTEE_TYPE.TRUSTEE_IS_UNKNOWN
End With
'Populate the explicit access rule for this user/permission
With ExplicitAccessRule(i)
'Set this to an Allow or Deny entry based on what was specified in the AllowOrDeny property
If SharePermissions(i).AllowOrDeny Then
.grfAccessMode = ACCESS_MODE.GRANT_ACCESS
Else
.grfAccessMode = ACCESS_MODE.DENY_ACCESS
End If
'Build the access mask for the share permission specified for this user
If SharePermissions(i).Permission = SharedFolder.SharePermissions.Read Then
.grfAccessPermissions = ACCESS_MASK.GENERIC_READ Or ACCESS_MASK.STANDARD_RIGHTS_READ Or ACCESS_MASK.GENERIC_EXECUTE
ElseIf SharePermissions(i).Permission = SharedFolder.SharePermissions.FullControl Then
.grfAccessPermissions = ACCESS_MASK.GENERIC_ALL
End If
'Not relevant for share permissions so just set to NO_INHERITANCE
.grfInheritance = NO_INHERITANCE
'Set the Trustee to the TRUSTEE structure we created earlier in the loop
.Trustee = Account
End With