Access Based Enumeration on Windows 7

Access Based Enumeration (ABE) is a well-hidden feature even in Windows Server, where it can be configured per share, but only in the Share and Storage Management MMC and not when right-clicking a folder in Explorer. Thanks to the shared code base ABE is available in Windows 7, too, although hidden even better. Let’s find out how to enable it anyway.

First we need a share to play around with. I set up a shared folder with three subfolders. When I access it over then network, everything looks as expected:

localhosttest_2012-02-02_16-52-54

Next we remove permissions on one of the subfolders so that users do not have read access any more. We do that with SetACL Studio, of course!

sub2 - SetACL Studio_2012-02-02_16-54-25

Then we download the free tool ShrFlgs and issue the following command in an elevated prompt:

D:\>ShrFlgs.exe \\localhost\test /abe true /forreal

ShrFlgs V01.00.01cpp Joe Richards (joe@joeware.net) February 2005

Share: test
  Path       : R:\
  Remark     :
  Max Use    : Unlimited
  Current Use: 1
  SDDL       :
  Flags
       Manual Client Side Caching
       Exclusive Opens Allowed
       Force Delete NOT Allowed
       Namespace Caching NOT Allowed
       Access Based Enumeration

The command completed successfully.

Finally we check again in Explorer, and voilà, the directory sub2 is gone:

localhosttest_2012-02-02_16-59-12
ABEAccess Based EnumerationFree ToolSetACL StudioShareWindows 7

Comments

Related Posts

How to Modify Default Share Permissions and Other Tweaks

NTFS permissions are stored in the file system, that is well known. But where are share permissions stored? As so often with Windows: in the registry. Network shares are defined by only a handful of relatively simple registry entries stored in the server service’s key which is, for historical reasons that go back way beyond OS/2, named “LanmanServer” (the workstation service is similarly named “LanmanWorkstation”).
Windows Internals

Latest Posts

Scripted WordPress to Hugo Migration

Scripted WordPress to Hugo Migration
After having published in WordPress for almost 20 years, it was time for a change. This site is now rendered by Hugo, a static website generator built for Markdown content hosted in a Git repository. The migration from WordPress (HTML) to Hugo (Markdown) was far from trivial. Since I couldn’t find any tool for the job, I developed my own set of migration scripts that fully automate the migration process. You can find them on GitHub along with extensive documentation.
Website