World: r3wp

You first asked this question > 3 hours ago, anyways :)

NO :-)

Well, I don't have an NT server running locally here, so I can't 
generate test data or even check its command line options.

don't worry. I am mostly done. It can be "almost" done, but nevertheless 
we will switch to VBScript ....

do I understand correctly, that it can be done in VBScript?

You would use VBScript as a replacement for the command line tool.

It's either that or powershell.

Well, I saw some examples and although I don't fully understand them, 
there might not be the place for REBOL. You can do everything in 
VB script, and that is what I don't like :-)

Or other languages with ActiveX support, and there are many.

But - the easiest way probably was to use mixture of REBOL and ICACLS 
CALLS - traversing recursively directories and querying ICACLS. That 
way I would always know the path, so it would be easy to strip it 
from output. Now as CALL is fixed and no more opens black console 
windows, REBOL is good tool.

R3 with ActiveX support, yes, can't wait for it :-)

What question does icacls ask about the access control lists? I don't 
have the tool locally.

http://www.mydigitallife.info/2007/04/30/icacls-vista-command-prompt-tool-to-manage-acls/

Looks like AccessChk: http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

It does not even have parameter to distinguish directory and file 
- what a lame tool. You have to use trick - icacls c:\some-dir\sub-dir-or-file*. 
, which is relict of 8.3 naming, so actually it will match and dir 
and file, not having suffix ....

What would lame MS do without buying Sysinternals guys escapes my 
mind ...

This is how they get their tech.

WTF :-) No I am upset about myself, as I use other SysInternal tools 
often, but dunno why I haven't looked for that tool mysel :-)

Haven't used it yet either.

ICACLS has a /save option - what does that output? It's supposed 
to be machine readable, unlike its stdout output.

it outputs complete mess. It almost looks like binary, but it is 
not - but no newlines, etc. It is kind of despaced output, which 
can be later used to set right back ....

Might be more parseable though.

there are no names though ... just SIDs ...

Following does what I need, and the output is nicer

accesschk.exe  -s -d L:\Sprava\* > ble.txt

-s recursion, -d dir-only

L:\My-dir\My-sub-dir
  Medium Mandatory Level (Default) [No-Write-Up]
  RW BUILTIN\Administrators
  RW WALMARK\AJMV

This is parseable ... maybe I can even use read/lines and skip the 
second line ...

It is just "not standard", e.g. If I would be planning (which I am 
not :-) to write simple Identity management, I would be probably 
better with "standard". This is already converted to R, W, etc.

If you don't need it, sure :)

All Vista shop then? The nearest person I know that runs Vista is 
more than 60 miles from me.

Windows console is so lame, that I have to use iconv to convert to 
win1250 first. It looks like they still live in DOS age :-)

Windows has moved on to ActiveX and PowerShell - the console is legacy.

Windows should be legacy :-)

OK, thanks for the tip. I don't even need to modify the output, it 
is ok right from the tool!

Pekr, does the output align/pad the paths so they are all the same 
length? i.e. columnar output?

Gregg - if you mean my former example, then - no, it does not. It 
really has to be bug in icacls, that the first item is being put 
on the first line appended behind the path ...

bug -> design flaw

yes

;Pekr, to avoide subdirectories with the spaces you can use this 
instead of my earlier example:


copy/part path find/reverse find/reverse find/reverse find path "(" 
"\" " " " "

Paul - that will not work. Because there is one exceptiong - NT AUTHORITY, 
which contains space ...

Which is a keyword. BUILTIN is another keyword.

But there can be also any domain name, not just keyword ....

Ah, but the list of domain names in your network is a fixed list. 
You can use that list to generate the look-for-a-domain rule.

Right Pekr, forgot about that.

I got it working. I use the following trick - I identify DOMAIN\USER:(RIGHT) 
or (RIGHT) sections first. Then I put weirdly markers around and 
catch the rest with the skip. The file is "clean", so actually what 
do I skip is either spaces, or path. I do check in emit function:

emit: does [
 if find tmp: trim copy/part p-start p-end ":\" [path: tmp]
 print [path domain user rights]
]

;--- rules - spaces, tabs, newlines

spacer-chars: charset [#" " #"^-" #"^/"]
spacers: [some spacer-chars]

;--- user-rights rules
;--- would be easier, if filesystem would not allow () ...

right-char: charset [#"A" - #"Z"]
right-rule: ["(" 1 2 right-char ")" ]

rights-rule: [r-start: some right-rule r-end: (rights: copy/part 
r-start r-end)]

;--- rule to identify user part

user-chars: complement charset {".,;:\/*}
user-rule: [copy user some user-chars ":" ]


;--- rule to identify domain - I expect it being typed in CAPITAL, 
can contain "-"
;--- the exception is "NT AUTHORITY" - contains space

domain-chars: charset [#"A" - #"Z" "-"]
domain-rule: [
    "NT AUTHORITY\" (domain: "NT AUTHORITY")
    |
     copy domain some domain-chars "\"  
]


;--- rules for combinations of: rights only (RIGHT), or DOMAIN\USER:(RIGT)
domain-user-rights: [
     rights-rule 
    |
     domain-rule
     user-rule
     rights-rule
]


parse/all str: read from-file [p-start: any [ p-end: domain-user-rights 
(emit) p-start: | skip ] to end]

lcase: charset "abcdefghijklmnopqrstuvwxyz"

copy/part path find/reverse find/reverse find/reverse find/reverse 
find path "(" "\" " " lcase " "

I'm assuming all usernames will be lowercase.

Windows doesn't use case specific usernames.

No, but they use case-preserving.

Even for the output of icalcs?