Using C++, I want to remove (not deny) Write permission alone from a user trustee with Full Control permission in Windows NTFS Folder.

Question

I want to implement a C++ program that removes the "Write" permission alone for a user trustee with "Full Control" permission over a folder on a Windows NTFS drive.

I tried to use the SetEntriesInAcl() function from the aclapi.h API,

but I failed to do so because "REVOKE_ACCESS" AccessMode removed the trustee itself.

I want to remove Write access (that is, I do not want to set a deny or allow access type). Please help me achieve this.

Note: I also tried the below method, which I do not want. Since it is not the correct solution for my needs.

I used "SET_ACCESS" as grfAccessMode, "GENERIC_READ | GENERIC_EXECUTE" as grfAccessPermissions and "SUB_CONTAINERS_AND_OBJECTS_INHERIT" as grfInheritance in EXPLICIT_ACCESS structure for SetEntriesInAcl function. - this gives the final result without "Write" permission, but our action is not like removing Specific permission alone.

Answer 1

Following incomplete snippet removes write access and leaves any other permissions in the access mask unchanged.

err = GetExplicitEntriesFromAcl(pDacl, &nEntries, &pExplicit);
if (!err)
{
    for (ULONG i = 0; i < nEntries; i++)
    {
        PEXPLICIT_ACCESS pea = &pExplicit[i];
        if (pea->Trustee.TrusteeForm != TRUSTEE_IS_SID)
        {
            _tprintf(_T("Trustee form was not a SID\n"));
            continue;
        }
        if (pea->Trustee.TrusteeForm == TRUSTEE_IS_SID)
        {
            if (EqualSid((PSID)pea->Trustee.ptstrName, pts2->Sid))
            {
                PACL pNewDacl{};

                pea->grfAccessMode = SET_ACCESS;

                // Remove permissions from access mask
                pea->grfAccessPermissions &= ~(WRITE_DAC | WRITE_OWNER | DELETE); // Standard rights
                pea->grfAccessPermissions &= ~(FILE_ADD_FILE | FILE_ADD_SUBDIRECTORY | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA | FILE_DELETE_CHILD); // specific rights

                err = SetEntriesInAcl(1, pea, pDacl, &pNewDacl);
                if (!err)
                {
                    err = SetNamedSecurityInfo(szFolder, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
                        nullptr, nullptr, pNewDacl, nullptr);

                    if (err)
                        ShowLastError(_T("SetNamedSecurityInfo"), err);

                    LocalFree(pNewDacl);
                }
                else
                    ShowLastError(_T("SetEntriesInAcl"), err);

                break;
            }
        }
    }

    LocalFree(pExplicit);
}
else
    ShowLastError(_T("GetExplicitEntriesFromAcl"), err);

The assumption used is that its OK to let SetNamedSecurityInfo handle propagation of permissions to subfolders/files based on the existing settings in the security descriptor.