Filesyetemobject get folder size permissions problem

Hi merowinger

Thanks for reply.  No joy, I have tried by running under system account using both schtasks and the AT command.  Both do not work

Also, I forgot to add, these servers are on different active directory domain. Could there be some group policy treesize adds itself in to??  Seems strange though

Cheers
Mark

marklye,

ok...then try this methods:
http://www.itnewsgroups.net/group/microsoft.public.windows.server.general/topic23538.aspx
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_23193272.html

merowinger

Have you considered the thought that maybe TreeSize goes down the tree first and gets the sizes of each of the lowest level folders and works it's way back up, ignoring folders it has no access to? I imagine this is what it does, as if you just try and get the size of the topmost folder you'll get a permission denied error straight away.

merowinger

cmdassys.exe - is the same as running a scheduled task under SYSTEM account
diruse - I can give it a go, but even running a simple dir command under system account does not work

c0ldfyr3

Yes I have consider this. However, when you view through the GUI, you can navigate to the directories, and view the contents of directories that I have no permission to, so it does capture it all.  I have changed my script too so when it comes across a permission denied error, it will start burrowing to the next level, and keep on trying to get directory size until it can go no further, and when I compare total size between my script and treesize, treesize collects much more.

Thanks!

marklye,

i think important with this cmdassys.exe is the interactive session!

merowinger

Hi merowinger

It doesnt seem to run on my W2K3 Server.  And its not in an encrypted directory as per release notes:

-> Windows 2000 (+later) user: Note, that the SYSTEM account
won't know your hash, so if you store the program in an
encrypted directory, the service cannot be started ;)

I have tried creating a scheduled tasks using interactive flag, but it does not allow for System account....

marklye,

hmm maybe with wmi it's working...
http://www.microsoft.com/technet/scriptcenter/resources/qanda/nov04/hey1118.mspx

merowinger

Already seen that article, which admits WMI doesnt work for this purpose:

Unfortunately, this script wont do you any good, not because of any problem with the scripting code or the scripting syntax, but simply because the FileSize property doesnt work. It doesnt matter what folder you connect to and it doesnt matter whether the folder is on the local computer or a remote computer: the FileSize will always come back Null.

And then it suggests file system object...

marklye,

ok i understand...atm i see no option :/

merowinger

An application can temporarily disable NTFS permissions by enabling the SeBackupPrivilege privilege.   That's how your backup program is able to read files that it otherwise would not have permissions to do so.  Obviously, you'd need to be in the local Administrators group to enable this privilege

http://msdn.microsoft.com/en-us/library/aa446619.aspx

If you're interested, I've got a VB.Net example on how to set this privilege...

Hi graye

Ok, this looks very interesting!  A load of questions if you dont mind!

1)If Im reading the example right, would this have to be run on the server that Im trying to interrogate?
2) Would this privilege have to be set on each server it interrogates or only on the server it is being run from?
3) Does this enable these powerful privileges for every user?  Or purely the account running the script?  Or can you set that?
4) Would the flow be a) set privilege b) run script c) remove privilege?

Sorry for all the q's, just trying to get my head round it

Thanks
Mark

1) The privilege is based upon the user account, not the PC.   So, I usually just set it at both the local PC and the remote PC

2) Yes, each server and the "local" PC

3) Whoa...  that's a privilege that you only set via a program (not like an item in SECPOL.MSC)... and you'd only do that temporarily.   So, only user accounts that are in the Administrators group (on both system, if you're doing it my way) are eligible for this elevated privilege.    So, the acount used would typically be in the Domain Admin group.

4) The privilege is not "transferable".... so that means you can not grant that privilege and then use it to launch another application.   So, I rather doubt you'd be able to run a script (as that's another application).   Instead, you'd have to write your own application (perhaps in VB.Net?) to perform the functions that are currently beign performed by the script

Ok thanks a million for this.  Soudsn great.  I would be really interested if I  could see that VB .NET example I could work from?  Have done quite a bit of VB .NET so happy to write the whole program in this

Thanks again
Mark

Thanks very much for this graye

Quick question before I assign you points!  Do the privilege automatically get removed when the process dies?  If it doesnt, would I need to add a identical function to "Public Function SetPrivileges(ByVal RemotePC As String) As Boolean", except change the AdjustTokenPrivileges calling statement to TRUE such as:

Thanks again

        ' enable the privileges
        If Not AdjustTokenPrivileges(hToken, True, tp, 0, IntPtr.Zero, len) Then
            Return False
        End If

                                              

1:
2:
3:
4:

That's correct... by it's very nature, it's very temporary.   When the process ends, the privilege is no longer present

That's correct, I didn't include a RemovePrivileges function in my example... it would be essentially the same except for the SE_PRIVILEGE_DISABLED = 0 constant.