subinacl 强大而不足

subinacl 强大而不足

subinacl 强大在于，几乎对所有对象设置访问权限。

最大的不足是不再更新了。

下面是帮助中的一部分：

FEATURES

describes SubInAcl main features
SubInAcl was designed to help administrators to manage security on various objects.
It provides :
- a unified way to manipulate security for different kinds of objects
(files, registry keys, services, printer,…)
- a console tool that allows to write scripts to automate
security tasks
- some features that help administrators to modify security if some
changes occur in their organization:
- user, group deletions (/suppresssid, /cleandeletedsidsfrom )
- user, group migrations (/replace , /accountmigration)
- domain, server migration (/changedomain, /migratetodomain)
…
- security descriptor editing features :
- owner ( /setowner )
- primary group ( /setprimarygroup )
- permissions ( /grant , /deny , /revoke )
- audit ( /sgrant, /sdeny, /sallowdeny)
- access to remote objects
- save and restore permissions (/playfile , /outputlog , /display )

You need SeBackupPrivilege SeRestorePrivilege
SeSecurityPrivilege SeTakeOwnershipPrivilege
SeChangeNotifyPrivilege privileges (locally or remotely) to run this tool

subinacl /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /setowner=administrators /setprimarygroup=administrators /grant=administrators=f


本要对 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing 进行权限修改，却变成了对 HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Component Based Servicing 的修改。

对下面的注册表项极其子项进行授权
HKEY_LOCAL_MACHINE\system\ControlSet001\Services

subinacl /keyreg "HKEY_LOCAL_MACHINE\system\ControlSet001\Services" /grant=administrators=f
subinacl /keyreg "HKEY_LOCAL_MACHINE\system\ControlSet001\Services" /grant=system=f

对子项进行授权之前，要先取得所有权
subinacl /subkeyreg "HKEY_LOCAL_MACHINE\system\ControlSet001\Services" /setowner=system

接着，就可以授权了
subinacl /subkeyreg "HKEY_LOCAL_MACHINE\system\ControlSet001\Services" /grant=administrators=f
subinacl /subkeyreg "HKEY_LOCAL_MACHINE\system\ControlSet001\Services" /grant=system=f