如何在Windows中获得服务器打印机的DACL？

Question

语境：Windows7的64位，ActiveDirectory中，Windows Server 2003的

我试图让微软的GetSecurityDescriptor method of the Win32_Printer Class (Windows)页上给出工作的代码。我有点好奇，想知道winmgmts的双重实例是如何工作的，即（从他们的代码）

Set objWMIService = GetObject("winmgmts:" _ 
& "{impersonationLevel=impersonate, (Security)}!\\" & strComputer & "\root\cimv2") 

Set objWMIService = GetObject("winmgmts:") 

我本来认为二审会揍第一。这似乎表明，无论我在strComputer中输入什么服务器名称，我仍然可以看到计算机上的打印机列表。

有没有人有使用VBScript获得服务器连接打印机的DACL的乐趣？

Answer 1

你是正确的，有超过一件事错的脚本，这里是一个工作版本

SE_DACL_PRESENT = &h4 
ACCESS_ALLOWED_ACE_TYPE = &h0 
ACCESS_DENIED_ACE_TYPE = &h1 

strComputer = "xxxxxxxxxx" 
strUser = "xxxxxxxxxxxx" 
strPassword = "xxxxxxx" 
strDomain = "xxx" 

Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator") 
Set objSWbemServices = objSWbemLocator.ConnectServer(strComputer, _ 
    "root\cimv2", _ 
    strUser, _ 
    strPassword, _ 
    "MS_409", _ 
    "ntlmdomain:" + strDomain) 

Set colInstalledPrinters = objSWbemServices.ExecQuery ("Select * from Win32_Printer") 

On error resume next 

For Each objPrinter in colInstalledPrinters 
    Wscript.Echo "Name: " & objPrinter.Name 
    Return = objPrinter.GetSecurityDescriptor(objSD) 
    If (return = 2) Then 
    WScript.Echo "Could not get security descriptor: " & Return 
    Elseif (return = 8) Then 
    WScript.Echo "Unknown failure: " & Return 
    Elseif (return = 9) Then 
    WScript.Echo "The user does not have adequate privileges to execute the method: " & Return 
    Elseif (return = 21) Then 
    WScript.Echo "A parameter specified in the method call is not valid: " & Return 
    Elseif (return = 0) Then 
    intControlFlags = objSD.ControlFlags 
    If intControlFlags AND SE_DACL_PRESENT Then 
     arrACEs = objSD.DACL 
     For Each objACE in arrACEs 
     WScript.Echo objACE.Trustee.Domain & "\" & objACE.Trustee.Name 
     If objACE.AceType = ACCESS_ALLOWED_ACE_TYPE Then 
      WScript.Echo vbTab & "User has access to printer" 
     ElseIf objACE.AceType = ACCESS_DENIED_ACE_TYPE Then 
      WScript.Echo vbTab & "User does not have access to the printer" 
     End If 
     Next 
    Else 
     WScript.Echo "No DACL found in security descriptor" 
    end if 
    Else 
    WScript.Echo "Could not get security descriptor: " & Return 
    End If 
Next 

= >>在我的领域这给ACL两次每个用户，可以由引起方式安全

Name: printer1 
\CREATOR OWNER 
    User has access to printer 
\CREATOR OWNER 
    User has access to printer 
MCM\DomainUsers 
    User has access to printer 
MCM\DomainUsers 
    User has access to printer 
MCM\DomainUsers 
    User has access to printer 
MCM\admin 
    User has access to printer 
MCM\admin 
    User has access to printer 
BUILTIN\Administrators 
    User has access to printer 
BUILTIN\Administrators 
    User has access to printer