Sub test()
' Connect to WMI and get the file security object for the testfolder directory
Set wmiFileSecSetting = GetObject("winmgmts:Win32_LogicalFileSecuritySetting.path='c:\program files'")
' Use the Win32_LogicalFileSecuritySetting Caption property to create a simple header before
' dumping the discretionary access control list (DACL).
' WScript.Echo wmiFileSecSetting.Caption & ":" & vbCrLf
MsgBox wmiFileSecSetting.Caption & ":" & vbCrLf
' Obtain existing security descriptor for folder
RetVal = wmiFileSecSetting.GetSecurityDescriptor(wmiSecurityDescriptor)
If Err <> 0 Then
' WScript.Echo "GetSecurityDescriptor failed" & vbCrLf & Err.Number & vbCrLf & Err.Description
' WScript.Quit
MsgBox "GetSecurityDescriptor failed" & vbCrLf & Err.Number & vbCrLf & Err.Description
Exit Sub
Else
' WScript.Echo "GetSecurityDescriptor suceeded"
MsgBox "GetSecurityDescriptor suceeded"
End If
' Retrieve the content of Win32_SecurityDescriptor DACL property.
' The DACL is an array of Win32_ACE objects.
DACL = wmiSecurityDescriptor.DACL
' Display the control flags in the descriptor.
MsgBox "Control Flags: " & wmiSecurityDescriptor.ControlFlags
' WScript.Echo "Control Flags: " & wmiSecurityDescriptor.ControlFlags
' Obtain the trustee for each access control entry (ACE) and change the permissions
' in the AccessMask for each ACE to read, write, and delete.
For Each wmiAce In DACL
' Get Win32_Trustee object from ACE
Set Trustee = wmiAce.Trustee
' wscript.echo "Trustee Domain: " & Trustee.Domain
MsgBox "Trustee Name: " & Trustee.Name
MsgBox "Access Mask: " & wmiAce.AccessMask
' WScript.Echo "Trustee Name: " & Trustee.Name
' WScript.Echo "Access Mask: " & wmiAce.AccessMask
' Set read access to the owner, group, and DACL of the security descriptor (131072)
‘我没弄清这个131072代表的含义，但这个数=2^17
wmiAce.AccessMask = 16384
MsgBox "Access Mask: " & wmiAce.AccessMask
' WScript.Echo "Access Mask: " & wmiAce.AccessMask
Next
' Call the Win32_LogicalFileSecuritySetting.SetSecurityDescriptor method
' to write the new security descriptor.
RetVal = wmiFileSecSetting.SetSecurityDescriptor(wmiSecurityDescriptor)