DumpSec problem with some permissions

[Guest]

Hello,

Today I experienced the following problem with DumpSec on my XP Prof SP2.
I set up to display only differences.
The result in the test folder:
C:\Test\ STEBERLTP\Administrators all all
C:\Test\ STEBERLTP\Users R X R X
C:\Test\ STEBERLTP\Users ax00100006

C:\Test\T1\ STEBERLTP\Administrators all all
C:\Test\T1\ STEBERLTP\Users R X R X
C:\Test\T1\ STEBERLTP\Users ax00100006

But if I modify the permissions of c:\test
Users:Create Files/Write Data and Create Folders/Append Data entry scope modifided from "This folder and subfolders" to "This folder, subfolders and files" the program works as expected:
C:\Test\ STEBERLTP\Administrators all all
C:\Test\ STEBERLTP\Users ax001200af ax001200af

Is there any solution?

Thanks & kind regards,
Krisztian.

[cmccullough]

Re: DumpSec problem with some permissions

It looks like DumpSec is running across a security setting that is not valid, or it doesn't understand.

When you modify the security you are probably removing the invalid entry, which then changes what DumpSec reports.

You might want to try our Exporter Pro utility that comes with Hyena for this reporting.

[Guest]

Re: DumpSec problem with some permissions

Hello,

There is nothing invalid.
If the following contition is true, the DumpSec produces bad result:

1. There is a DACL on "this folder, subfolders and files", permission "Read & Execute"
2. AND there is a DACL on "this folder, subfolders", permission "Create Files/Write Data and Create Folders/Append Data" (for the same user!) (this produces 2 DACLs because of the different scope)

If any of the DALCs is deleted, the DumpSec produces the right result.

Kind regards,
Krisztian

[kstanush]

Re: DumpSec problem with some permissions

DumpSec does not know how to interpret some security settings, which is why you get the strange number on the first output. What this would do to the exception reporting (only show differences) is unpredictable. Since you have two ACEs, you are getting two lines for that, although one cannot be interpreted.

I would use Exporter Pro for this, as it was written from the ground up to handle any possible combination of permissions.