Setting NTFS Permissions with C#

Feb 08, 2004
by David Cumps

Originally published on my old blog at cumps.be on February 8, 2004.

Today I needed to set NTFS permissions in C# on some newly created directories.

No problem I thought, the CLR will have something for it somewhere in Security, so I checked Google in the hopes to find which class to use.

But Google didn’t find anything… This amazed me. “Why can’t I control NTFS permissions with .NET?!?”

After looking for an hour or so, I found a GotDotNet User Sample, called ‘ACLs in .NET’. Finally I thought, now it’s going to be plug-in and set rights.

Well this library is great. It makes setting NTFS rights so easy.

But it lacks a bit in documentation. Therefore I’m providing some of the code I used with it, it could help you. (or it could show my possibly bad coding style, as far as I know, it should be fine)

Reference the DLL, and use it:

using Microsoft.Win32.Security;

Here’s a method to add a dir, and set NTFS permissions on it for a given user:

private Boolean CreateDir(String strSitePath, String strUserName) {
       Boolean bOk;

       try {
              Directory.CreateDirectory(strSitePath);
              SecurityDescriptor secDesc = SecurityDescriptor.GetFileSecurity(strSitePath, SECURITY_INFORMATION.DACL_SECURITY_INFORMATION);
              Dacl dacl = secDesc.Dacl;
              Sid sidUser = new Sid (strUserName);

              // allow: folder, subfolder and files
              // modify
              dacl.AddAce (new AceAccessAllowed (sidUser, AccessType.GENERIC_WRITE | AccessType.GENERIC_READ | AccessType.DELETE | AccessType.GENERIC_EXECUTE , AceFlags.OBJECT_INHERIT_ACE | AceFlags.CONTAINER_INHERIT_ACE));

              // deny: this folder
              // write attribs
              // write extended attribs
              // delete
              // change permissions
              // take ownership
              DirectoryAccessType DAType = DirectoryAccessType.FILE_WRITE_ATTRIBUTES | DirectoryAccessType.FILE_WRITE_EA | DirectoryAccessType.DELETE | DirectoryAccessType.WRITE_OWNER | DirectoryAccessType.WRITE_DAC;
              AccessType AType = (AccessType)DAType;
              dacl.AddAce (new AceAccessDenied (sidUser, AType));

              secDesc.SetDacl(dacl);
              secDesc.SetFileSecurity(strSitePath, SECURITY_INFORMATION.DACL_SECURITY_INFORMATION);
              bOk = true;
       } catch {
              bOk = false;
       }

       return bOk;

} /* CreateDir */