Solved

Powershell limits

Posted on 2012-04-03
9
2,050 Views
Last Modified: 2013-03-13
I'm trying to run a file system security audit on a W2k3 file server with a Powershell2.0 script, I've ran into a few problems:
1) I can't seem to log Folder permissions if my Domain Admin account doesn't have permission to the folder/file.
2) There appears to be a path limit of 260.
I'm using a script found here: http://jfrmilner.wordpress.com/2011/05/01/audit-ntfs-permissions-powershell-script/#comment-43

Is there a way to run a powershell script with "System" level or "Backup" level permissions to get by any directory access problem.
Is there a directory path limit in Powershell?
Thanks

Errors:
Get-ChildItem : The specified path, file name, or both are too long. The fully qualified file name must be less than 260 characters,
and the directory name must be less than 248 characters.
At C:\cmd\Get-PathPermissions.ps1:10 char:29
+ $containers = Get-ChildItem <<<< -path $Path -Recurse -Force | ? {$_.psIscontainer -eq $true}
+ CategoryInfo : ReadError: (F:\GroupData…ation work data:String) [Get-ChildItem], PathTooLongException
+ FullyQualifiedErrorId : DirIOError,Microsoft.PowerShell.Commands.GetChildItemCommand

Get-ChildItem : Access to the path 'F:\GroupData\Accounting\Cost Accounting Archives' is denied.
At C:\cmd\Get-PathPermissions.ps1:10 char:29
+ $containers = Get-ChildItem <<<< -path $Path -Recurse -Force | ? {$_.psIscontainer -eq $true}
+ CategoryInfo : PermissionDenied: (F:\GroupData…unting Archives:String) [Get-ChildItem], UnauthorizedAccessExcept
ion
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
0
Comment
Question by:Starrett2005
  • 5
  • 4
9 Comments
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
Comment Utility
Maximum path 260
This is a known problem, not all windows api's support more than the system MAXPATH of 260
Work Arounds

Is there a way to run a powershell script with "System" level or "Backup" level permissions to get by any directory access problem.
Is there a directory path limit in Powershell?


you could try starting powershell with a runas with a user that is a member of the backup operators group
0
 

Author Comment

by:Starrett2005
Comment Utility
MAXPATH:
I will try the \\?\ prefix and see if that works as described in: http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx

Script access to ACL on Directories/Files:
I already run the script as a Domain Admin (which has the Backup Privilege) and get the posted access errors. I remember that the utility RoboCopy has a switch to run with backup privilege when access is denied.  I'm trying to see if Powershell includes something similar.
0
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
Comment Utility
robocopy will then use VSS to copy the files
0
 

Author Comment

by:Starrett2005
Comment Utility
OK, that makes sense for Robocopy, but all backup software is somehow allowed to backup files even if the account scheduled to run the backup doesn't have access to the files interactively. Example: WindowsNT4.0 "ntbackup" app.  There must be some way for the Powershell script to gain this access to pull ACL's off of Folder/File objects.
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 

Author Comment

by:Starrett2005
Comment Utility
So far I haven't had any luck with the MAXPATH. Is there any other method to pull acl's from directories that have not been granted access to?
0
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
Comment Utility
no the security model won't allow this
0
 

Author Comment

by:Starrett2005
Comment Utility
ve3ofa,

Is there a Microsoft post available that would state this.  I need this to present to management before they aprove changing permissions on everything to allow an Admin account access so we can query ACL's appropriately.
0
 
LVL 78

Accepted Solution

by:
David Johnson, CD, MVP earned 500 total points
Comment Utility
If you can't access it via explorer then you can't access it via powershell, it is that simple NTFS file permissions. http://technet.microsoft.com/en-us/library/cc785144%28v=ws.10%29.aspx
0
 

Author Closing Comment

by:Starrett2005
Comment Utility
Thanks
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
Create and license users in Office 365 in bulk based on a CSV file. A step-by-step guide with PowerShell script examples.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now