World: r3wp

ICACLS has a /save option - what does that output? It's supposed 
to be machine readable, unlike its stdout output.

it outputs complete mess. It almost looks like binary, but it is 
not - but no newlines, etc. It is kind of despaced output, which 
can be later used to set right back ....

Might be more parseable though.

there are no names though ... just SIDs ...

Following does what I need, and the output is nicer

accesschk.exe  -s -d L:\Sprava\* > ble.txt

-s recursion, -d dir-only

L:\My-dir\My-sub-dir
  Medium Mandatory Level (Default) [No-Write-Up]
  RW BUILTIN\Administrators
  RW WALMARK\AJMV

This is parseable ... maybe I can even use read/lines and skip the 
second line ...

It is just "not standard", e.g. If I would be planning (which I am 
not :-) to write simple Identity management, I would be probably 
better with "standard". This is already converted to R, W, etc.

If you don't need it, sure :)

All Vista shop then? The nearest person I know that runs Vista is 
more than 60 miles from me.

Windows console is so lame, that I have to use iconv to convert to 
win1250 first. It looks like they still live in DOS age :-)

Windows has moved on to ActiveX and PowerShell - the console is legacy.

Windows should be legacy :-)

OK, thanks for the tip. I don't even need to modify the output, it 
is ok right from the tool!

Pekr, does the output align/pad the paths so they are all the same 
length? i.e. columnar output?

Gregg - if you mean my former example, then - no, it does not. It 
really has to be bug in icacls, that the first item is being put 
on the first line appended behind the path ...

bug -> design flaw

yes

;Pekr, to avoide subdirectories with the spaces you can use this 
instead of my earlier example:


copy/part path find/reverse find/reverse find/reverse find path "(" 
"\" " " " "

Paul - that will not work. Because there is one exceptiong - NT AUTHORITY, 
which contains space ...

Which is a keyword. BUILTIN is another keyword.

But there can be also any domain name, not just keyword ....

Ah, but the list of domain names in your network is a fixed list. 
You can use that list to generate the look-for-a-domain rule.

Right Pekr, forgot about that.

I got it working. I use the following trick - I identify DOMAIN\USER:(RIGHT) 
or (RIGHT) sections first. Then I put weirdly markers around and 
catch the rest with the skip. The file is "clean", so actually what 
do I skip is either spaces, or path. I do check in emit function:

emit: does [
 if find tmp: trim copy/part p-start p-end ":\" [path: tmp]
 print [path domain user rights]
]

;--- rules - spaces, tabs, newlines

spacer-chars: charset [#" " #"^-" #"^/"]
spacers: [some spacer-chars]

;--- user-rights rules
;--- would be easier, if filesystem would not allow () ...

right-char: charset [#"A" - #"Z"]
right-rule: ["(" 1 2 right-char ")" ]

rights-rule: [r-start: some right-rule r-end: (rights: copy/part 
r-start r-end)]

;--- rule to identify user part

user-chars: complement charset {".,;:\/*}
user-rule: [copy user some user-chars ":" ]


;--- rule to identify domain - I expect it being typed in CAPITAL, 
can contain "-"
;--- the exception is "NT AUTHORITY" - contains space

domain-chars: charset [#"A" - #"Z" "-"]
domain-rule: [
    "NT AUTHORITY\" (domain: "NT AUTHORITY")
    |
     copy domain some domain-chars "\"  
]


;--- rules for combinations of: rights only (RIGHT), or DOMAIN\USER:(RIGT)
domain-user-rights: [
     rights-rule 
    |
     domain-rule
     user-rule
     rights-rule
]


parse/all str: read from-file [p-start: any [ p-end: domain-user-rights 
(emit) p-start: | skip ] to end]

lcase: charset "abcdefghijklmnopqrstuvwxyz"

copy/part path find/reverse find/reverse find/reverse find/reverse 
find path "(" "\" " " lcase " "

I'm assuming all usernames will be lowercase.

Windows doesn't use case specific usernames.

No, but they use case-preserving.

Even for the output of icalcs?

Probably. Only the domains are uppercased.

Then with the find command I don't think it will be possible.

At least not without a table lookup.

What's the most economical way to do this.  I have a line of text, 
and I want to classify each line.  So, if I find the word "tablet" 
in it, I class this as a U2, and if I find "capsule", it's AV.

I can do a sequence of finds inside a case statement, or I can use 
a parse.  But in the first instance I have multiple find statements, 
but in the latter I have mutliple assignments in my code.

Economical how, in space, speed, or complexity? e.g., repeated FINDs 
can seem inelegant, but are easy to understand and maintain.

If lines match more than one rule, what is the desired behavior?


Assuming you have test data, and if performance is the key, have 
you done any quick tests?

elegant in looks :)

the lines are so few in number that it won't make any practical difference 
... just wondering if there were a preference on how to do this without 
code duplication.

I decided that since the way I was going to use parse, or case meant 
the code was mixed in with the data .. it was better to do it differently.

you need to maintain a map of keywords and codes   to that  in its 
own file and read it in to build your rules

sort it by keyword length  longest first

before building the rules 
then when codes change or mor are added you just update your map

basically what  ended up doing  :)

I'm puzzled about the difference result when using [to end end] and 
[thru end}. Anybody know why?

 >> parse "123456789" [to end end]
== true


>> parse "123456789" [thru end]

== false

note: 

parse "123456789" [to end]
== true

this has also puzzled me, since:

>> parse "123456789" [thru end here:] index? here
== 10
>> parse "123456789" [to end here:] index? here
== 10

maybe the rule thru fails because you can't actually go past the 
end.

just like this fails too. even though we are at the end:

>> print parse "123456789" [9 skip here:] index? here
true
== 10
>> print parse "123456789" [10 skip here:] index? here
false
== 10

it does make sense, and its consistent with parse... it only returns 
true when the last rule ends Exactly AT the end.

maybe the rule thru fails because you can't actually go past the 
end
 - but does [thru end] go past the end?