World: r3wp

Paul - good one - I thought about reversing the string from reaching 
the newline too ...

Also, seriously, consider switching utilities to one that gives you 
better output.

there's none other utility in default console :-)

but - I could also not do it all with one ICACLS call, but instead 
to REBOL level recursion and using separate CALL to ICACLS for each 
dir separately ...

But that ICACLS output run for > 3 hours, so I don't want to repeat 
it :-)

Since this is a one-off for a known network, flexibility is *really* 
overrated here. Go with the known domains method this time, then 
you'll have time to come up with a general solution for the next 
run.

You first asked this question > 3 hours ago, anyways :)

NO :-)

Well, I don't have an NT server running locally here, so I can't 
generate test data or even check its command line options.

don't worry. I am mostly done. It can be "almost" done, but nevertheless 
we will switch to VBScript ....

do I understand correctly, that it can be done in VBScript?

You would use VBScript as a replacement for the command line tool.

It's either that or powershell.

Well, I saw some examples and although I don't fully understand them, 
there might not be the place for REBOL. You can do everything in 
VB script, and that is what I don't like :-)

Or other languages with ActiveX support, and there are many.

But - the easiest way probably was to use mixture of REBOL and ICACLS 
CALLS - traversing recursively directories and querying ICACLS. That 
way I would always know the path, so it would be easy to strip it 
from output. Now as CALL is fixed and no more opens black console 
windows, REBOL is good tool.

R3 with ActiveX support, yes, can't wait for it :-)

What question does icacls ask about the access control lists? I don't 
have the tool locally.

http://www.mydigitallife.info/2007/04/30/icacls-vista-command-prompt-tool-to-manage-acls/

Looks like AccessChk: http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

It does not even have parameter to distinguish directory and file 
- what a lame tool. You have to use trick - icacls c:\some-dir\sub-dir-or-file*. 
, which is relict of 8.3 naming, so actually it will match and dir 
and file, not having suffix ....

What would lame MS do without buying Sysinternals guys escapes my 
mind ...

This is how they get their tech.

WTF :-) No I am upset about myself, as I use other SysInternal tools 
often, but dunno why I haven't looked for that tool mysel :-)

Haven't used it yet either.

ICACLS has a /save option - what does that output? It's supposed 
to be machine readable, unlike its stdout output.

it outputs complete mess. It almost looks like binary, but it is 
not - but no newlines, etc. It is kind of despaced output, which 
can be later used to set right back ....

Might be more parseable though.

there are no names though ... just SIDs ...

Following does what I need, and the output is nicer

accesschk.exe  -s -d L:\Sprava\* > ble.txt

-s recursion, -d dir-only

L:\My-dir\My-sub-dir
  Medium Mandatory Level (Default) [No-Write-Up]
  RW BUILTIN\Administrators
  RW WALMARK\AJMV

This is parseable ... maybe I can even use read/lines and skip the 
second line ...

It is just "not standard", e.g. If I would be planning (which I am 
not :-) to write simple Identity management, I would be probably 
better with "standard". This is already converted to R, W, etc.

If you don't need it, sure :)

All Vista shop then? The nearest person I know that runs Vista is 
more than 60 miles from me.

Windows console is so lame, that I have to use iconv to convert to 
win1250 first. It looks like they still live in DOS age :-)

Windows has moved on to ActiveX and PowerShell - the console is legacy.

Windows should be legacy :-)

OK, thanks for the tip. I don't even need to modify the output, it 
is ok right from the tool!

Pekr, does the output align/pad the paths so they are all the same 
length? i.e. columnar output?

Gregg - if you mean my former example, then - no, it does not. It 
really has to be bug in icacls, that the first item is being put 
on the first line appended behind the path ...

bug -> design flaw

yes

;Pekr, to avoide subdirectories with the spaces you can use this 
instead of my earlier example:


copy/part path find/reverse find/reverse find/reverse find path "(" 
"\" " " " "

Paul - that will not work. Because there is one exceptiong - NT AUTHORITY, 
which contains space ...

Which is a keyword. BUILTIN is another keyword.

But there can be also any domain name, not just keyword ....

Ah, but the list of domain names in your network is a fixed list. 
You can use that list to generate the look-for-a-domain rule.

Right Pekr, forgot about that.