SetACL Archives • Helge Klein

Finding (Executables in) User-Writeable Directories

This article presents two different detection types for insecure filesystem permissions on Windows endpoints: scanning for directories that are user-writable, and detecting processes that are started from user-writeable directories.

The SetACL Shirt Shop Has Opened

What could be geekier than a t-shirt imprinted with actual source code from a tool that helps administrators around the world tame one of the most dreaded beasts in IT: permissions? Our SetACL shirt is available in several shapes. Hop on over to the t-shirt shop and get your own!

Windows 7 Default HKCU Registry Permissions

This is a complete listing of all Windows 7 HKEY_CURRENT_USER registry permissions. The list was generated on a 32-bit installation with SetACL. More default permission listings can be found here.

Finding and Removing Orphaned SIDs in File Permissions, or: Busting the Ghosts Built Into Windows 7

Due to a lack of visibility permission cleanup is performed far less frequently than it could, and probably should. As a result, ghost ACEs (permissions from deleted accounts) linger in the dark corners of the file system, threatening the unsuspecting admin with the horrors of unresolvable SIDs.

HowTo: ReACLing a File Server in a Domain Migration with SetACL 3.0

When you are planning a migration of user accounts between domains one task always pops up pretty quickly: reassigning the permissions of the users in the source domain to the corresponding users in the target domain, in other words reACLing the file server.

Half a Million Downloads of SetACL

Last month SetACL reached the magic number of 500,000 downloads. That is a lot, especially for a command-line tool which is focused on a very specific aspect of system administration. It took roughly nine years to get from 0 to 500,000. During that time people from 194 different countries visited SetACL’s web site. Those are […]

Geek Fashion

This is what I’ll be wearing at next week’s WINone: And yes, the letters are made up of actual source code ;-)

Free Script: User Profile Domain Migration with SetACL

This article is part of Helge’s Profile Toolkit, a set of posts explaining the knowledge and tools required to tame Windows user profiles. When administrators migrate user accounts between domains, they typically re-ACL those server resources users have access to. In plain English: they copy or move the permissions from the accounts of the old […]

Taking Ownership Fails With UNC Path, Works Locally!?! Why?

Here is an interesting tidbit related to Windows security: Create a test file share, e.g. C:\temp\test, and share it with full permissions for everyone (share, not NTFS permissions) as “test” Create the following directory hierarchy below the share: C:\temp\test\1\2\3\4 Assign ownership of the four folders 1, 2, 3 and 4 to any user (but do […]

Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained

Updated: 2021-06-22 Every object that can have a security descriptor (SD) is a securable object that may be protected by permissions. All named and several unnamed Windows objects are securable and can have SDs, although this is not widely known. There does not even exist a GUI for manipulating the SDs of many object types! […]

How to Prevent Users from Changing Permissions on File Servers

On file servers in corporate environments one typically does not want users to change permissions, even on their own files. It might seem that it would be sufficient to simply grant change permissions instead of full control, but unfortunately that is not the case. The problem is that whenever a new file gets created, the […]

Tag: SetACL

Finding (Executables in) User-Writeable Directories

The SetACL Shirt Shop Has Opened

Windows 7 Default HKCU Registry Permissions

Finding and Removing Orphaned SIDs in File Permissions, or: Busting the Ghosts Built Into Windows 7

HowTo: ReACLing a File Server in a Domain Migration with SetACL 3.0

Half a Million Downloads of SetACL

Geek Fashion

Free Script: User Profile Domain Migration with SetACL

Taking Ownership Fails With UNC Path, Works Locally!?! Why?

Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained

How to Prevent Users from Changing Permissions on File Servers