I am running the script a command line from my workstation (I am using an account which does not have domain administrator permissions)
ESM is installed on my Workstation
I will try running the script with the /e2kstore+ when I back on site.
I don't recall seeing that error code being displayed.#
thanks for your continued help Alain
Alain Lissoir <[EMAIL PROTECTED]> wrote:
Where are you running the script?On your workstation or your server?On your workstation is the ESM installed?If yes, can you try to run the script with the /E2KStore+ switch instead?Is this error message coming with an error # 0x8007203A?
From: Amy Hunter [mailto:[EMAIL PROTECTED]
Sent: Tuesday, December 06, 2005 2:18 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Exporting Mailbox rightsThank you Alain,I followed your instructions, I registered the DLL's on my PC then ran the following command from the XYZ folderFor /F "delims=*" %1 in ('dsquery * "ou=group mailboxes,ou=spinnaker,dc=org" -filter "(objectClass=user)"') do WMIManageSD.Wsf /E2KMailbox:"%1" /Decipher+ /ADSI+This runs and it does pick up the group mailbox in this OU.I then receive a message saying "WMIManageSD.Wsf(888, 19) (null): The server is not operational"Do I need to specify somewhere in the script my domain/server details? Am I able to output this information into a text file?thanks for your help, sorry I am being a pain.Amy ;-)
Alain Lissoir <[EMAIL PROTECTED]> wrote:Do you have the Functions folder available? It contains a series of functions used by WMIManageSD.WsfNext you must register the DLL with REGSVR32 in the resource folder. Then you are all set.By default, WMIManageSD.Wsf must be in Folder XYZ while Functions folder must be at the same level.Root +-------- Functions|+-------- XYZOtherwise you can change the "..\Functions" reference to an absolute path and point to the exact location of the Functions folder in your installation (you call).To run against a group of MB in an OU, just query the users you have in that OU with DSQUERY (or any equivalent tool) and combine them in a command like:(one single when you type. Line is cut for readability reasons in this mail).For /F "delims=*" %i in ('dsquery * "ou=group mailboxes,OU=,DC=spinnaker,DC=org"
-filter "(objectClass=user)"') do
WMIManageSD.Wsf /E2KMailbox:"%1" /Decipher+ /ADSI+HTH.PS: Don't forget the + at the end of the /Decipher+ and /ADSI+ switches.
From: Amy Hunter [mailto:[EMAIL PROTECTED]
Sent: Monday, December 05, 2005 4:41 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Exporting Mailbox rightsHi Alain,thanks for your response, it all looks very clever.;I have tried running the following command:WMIManageSD.Wsf /E2KMailbox:"cn=POTrust,ou=group mailboxes,OU=,DC=spinnaker,DC=org" /adsiWMIManageSD.Wsf /E2KMailbox:"cn=POTrust,ou=group mailboxes,OU=,DC=spinnaker,DC=org" /decipherI receive this error "c:\WMIManageSD.Wsf(155, 39) Windows Script Host: Cannot retrieve referenced URL : ..\Functions\SecurityInclude.vbs"when I open this script, i can't see any reference to this....Also, How can I run this against all group mailboxes in an OU>any ideas?Amy ;-)Ps...sorry if I sound lame, scripting is not an area I spent too much time with Yet.< /DIV>
Alain Lissoir <[EMAIL PROTECTED]> wrote:You can look at http://www.lissware.net, volume 2, Sample 4.02 to 4.13 - WMIManageSD.Wsf (and associated sub-functions in the Functions folder).Syntax to use in red below (the script supports Filesystem, Share, ADObject with Extended Rights, Exchange Mailbox, Registry Key, WMI namespace).Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.Usage: WMIManageSD.Wsf [/FileSystem:value] [/Share:value] [/ADObject:value] [/E2KMailbox:value] [/E2KStore[+|-]] [/RegistryKey:value] [/WMINameSpace:value] [/ViewSD[+|-]] [/Owner:value] [/Group:value] [/SDControls:value] [/AddAce[+|-]] [/DelAce[+|-]] [/Trustee:value] [/ACEMask:value] [/ACEType:value] [/ACEFlags:value] [/ObjectType:value] [/InheritedObjectType:value] [/SACL[+|-]] [/Decipher[+|-]] [/ADSI[+|-]] [/SIDResolutionDC[+|-]] [/Machine:value] [/User:value] [/Password:value]Options:FileSystem : Get the security descriptor of the specified file or directory path.
Share : Get the security descriptor of the specified share name.
ADObject : Get the security descriptor of the specified distinguished name AD object.
E2KMailbox : Get the security descriptor of the Exchange 2000 mailbox specified by AD user distinguished name.
E2KStore : Specify if th e security descriptor must come from the Exchange 2000 store.
RegistryKey : Get the security descriptor of the specified registry key.
WMINameSpace : Get the security descriptor of the specified WMI Name space.
ViewSD : Decipher the security descriptor.
Owner : Set the security descriptor owner.
Group : Set the security descriptor group.
SDControls : Set the security descriptor control flags.
AddAce : Add a new ACE to the ACL.
DelAce : Remove an existing ACE from the ACL.
Trustee & nbsp; : Specify the ACE mask (granted user, group or machine account).
ACEMask : Specify the ACE mask (granted rights).
ACEType : Specify the ACE type (allow or deny the ACE mask).
ACEFlags : Specify the ACE flags (ACE mask inheritance).
ObjectType : Specify which object type, property set, or property an ACE refers to.
InheritedObjectType : Specify the GUID of an object that will inherit the ACE..
SACL : Manage the System ACL (auditing) (default=Discretionary ACL).
Decipher : Decipher the security descriptor.
ADSI : Retrieve the security descriptor with ADSI.
SIDResolutionDC : Domain Controller to use for SID resolution.
Machine : Determine the WMI system to connect to. (default=LocalHost)
User : Determine the UserID to perform the remote connection. (default=none)
Password : Determine the password to perform the remote connection. (default=none)
Examples:>>Viewing Security descriptors ...
>>Files and Folders -----------------------------------------------------------------------
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Decipher+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Decipher+ /ADSI+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Decipher+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Decipher+ /ADSI+>>Share -----------------------------------------------------------------------------------
WMIManageSD.Wsf /Share:MyDirectory /Decipher+>>AD object -------------------------------------------------------------------------------
WMIManageSD.Wsf /ADObject:"user;CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+
WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+ /ADSI+>>Exchange 2000 mailbox -------------------------------------------------------------------
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /D ecipher+
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+ /ADSI+
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+ /E2KStore+>>Registry --------------------------------------------------------------------------------
WMIManageSD.Wsf /RegistryKey:HKLM\SOFTWARE\Microsoft /Decipher+ /ADSI+>>WMI namespace ---------------------------------------------------------------------------
WMIManageSD.Wsf /WMINameSpace:Root\CIMv2 /Decipher+>>Adding ACE in Security descriptors ...
>>Files (Rights) --------------------------------------------------------------------------
WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_GENERIC_READ /ACEFlags:NONE /AddAce+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:BUILTIN\Administrators /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_ALL_ACCESS /ACEFlags:NONE /AddAce+>>Files (Audit) ---------------------------------------------------------------------------
WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:BUILTIN\Administrators /ACEType:SYSTEM_AUDIT_ACE_TYPE /ACEMask:FILE_WRITE_OWNER /ACEFlags:SUCCESSFUL_ACCESS_ACE_FLAG /AddAce+ /SACL+>>Folders (Rights) ------------------------------------------------------------------------
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_GENERIC_READ /ACEFlags:OBJECT_INHERIT_ACE,CONTAINER_INHERIT_ACE /AddAce+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FOLDER_ADD_FILE,FILE_SYNCHRONIZE /ACEFlags:OBJECT_INHERIT_ACE,CONTAINER_INHERIT_ACE /AddAce+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:EMEA\MyOtherUser /SIDResolutionDC:MyDC01.Emea.LissWare.Net /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_GENERIC_READ /ACEFlags:OBJECT_INHERIT_ACE,CONTAINER_INHERIT_ACE /AddAce+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Owner:BUILTIN\Administrators>>Folders (Au dit) -------------------------------------------------------------------------
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:Everyone /ACEType:SYSTEM_AUDIT_ACE_TYPE /ACEMask:FILE_DELETE /ACEFlags:INHERIT_ONLY_ACE,SUCCESSFUL_ACCESS_ACE_FLAG /AddAce+ /SACL+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:BUILTIN\Administrators /ACEType:SYSTEM_AUDIT_ACE_TYPE /ACEMask:FILE_DELETE,FILE_WRITE_OWNER /ACEFlags:SUCCESSFUL_ACCESS_ACE_FLAG,CONTAINER_INHERIT_ACE,OBJECT_INHERIT_ACE /AddAce+ /SACL+ /ViewSD+ /Decipher+>>Share -----------------------------------------------------------------------------------
WMIManageSD.Wsf /Share:MyDirectory /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_SHARE_READ_ACCESS /ACEFlags:NONE /AddAce+
WMIManageSD.Wsf /Share:MyDirectory /Trustee:BUILTIN\Administrators /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_SHARE_FULL_ACCESS,FILE_SHARE_CHANGE_ACCESS,FILE_SHARE_READ_ACCESS /ACEFlags:NONE /AddAce+>>AD object (Rights) ----------------------------------------------------------------------
WMIManageSD.Wsf /ADObject:"user;CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:ADS_RIGHT_READ_CONTROL,ADS_RIGHT_ACTRL_DS_LIST,ADS_RIGHT_DS_READ_PROP /ACEFlags:ADS_ACEFLAG_OBJECT_INHERIT_ACE,ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+
WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:ADS_RIGHT_READ_CONTROL,ADS_RIGHT_ACTRL_DS_LIST,ADS_RIGHT_DS_READ_PROP /ACEFlags:ADS_ACEFLAG_OBJECT_INHERIT_ACE,ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+ /ADSI+>>AD object (Extended Rights) -------------------------------------------------------------
WMIManageSD.W sf /ADObject:"user;CN=MyObject,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_ACCESS_DENIED_OBJECT /ACEMask:ADS_RIGHT_DS_CONTROL_ACCESS /ACEFlags:ADS_ACEFLAG_OBJECT_INHERIT_ACE,ADS_ACEFLAG_CONTAINER_INHERIT_ACE /ObjectType:{AB721A53-1E2F-11D0-9819-00AA0040529B} /AddAce+
WMIManageSD.Wsf /ADObject:"CN=MyObject,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_ACCESS_DENIED_OBJECT /ACEMask:ADS_RIGHT_DS_CONTROL_ACCESS /ACEFlags:ADS_ACEFLAG_OBJECT_INHERIT_ACE,ADS_ACEFLAG_CONTAINER_INHERIT_ACE /ObjectType:{AB721A53-1E2F-11D0-9819-00AA0040529B} /AddAce+ /ADSI+
WMIManageSD.Wsf /ADObject:"user;CN=MyObject,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_ACCESS_DENIED_OBJECT /ACEMask:ADS_RIGHT_DS_CREATE_CHILD /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE,ADS_ACEFLAG_INHERIT_ONLY_ACE /ObjectType:{A8DF74C1-C5EA-11D1-BBCB-0080C76670C0} /InheritedObjectType:{E934CB68-A980-11D2-A9FF-00C04F8EEDD8} /AddAce+
WMIManageSD.Wsf /ADObject:"CN=MyObject,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_ACCESS_DENIED_OBJECT /ACEMask:ADS_RIGHT_DS_CREATE_CHILD /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE,ADS_ACEFLAG_INHERIT_ONLY_ACE /ObjectType:{A8DF74C1-C5EA-11D1-BBCB-0080C76670C0} /InheritedObjectType:{E934CB68-A980-11D2-A9FF-00C04F8EEDD8} /AddAce+ /ADSI+>>AD object (Audit) -----------------------------------------------------------------------
WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_SYSTEM_AUDIT /ACEMask:ADS_RIGHT_READ_CONTROL,ADS_RIGHT_ACTRL_DS_LIST,ADS_RIGHT_DS_READ_PROP /ACEFlags:ADS_ACEFLAG_SUCCESSFUL_ACCESS,ADS_ACEFLAG_CONTAINER_INHERIT_ACE,ADS_ACEFLAG_OBJECT_INHERIT_ACE /AddAce+ /ADSI+ /SACL+>>Exchange 2000 mailbox -------------------------------------------------------------------
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:BUILTIN\Administrators /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:E2K_MB_FULL_MB_ACCESS,E2K_MB_SEND_AS,E2K_MB_READ_PERMISSIONS /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:BUILTIN\Administr ators /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:E2K_MB_FULL_MB_ACCESS,E2K_MB_SEND_AS,E2K_MB_READ_PERMISSIONS /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+ /ADSI+
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:BUILTIN\Administrators /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:E2K_MB_FULL_MB_ACCESS,E2K_MB_SEND_AS,E2K_MB_READ_PERMISSIONS /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+ /E2KStore+>>Registry --------------------------------------------------------------------------------
WMIManageSD.Wsf /RegistryKey:HKLM\SOFTWARE\Microsoft /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:REG_GENERIC_READ /ACEFlags:CONTAINER_INHERIT_ACE /AddAce+ /ADSI+>>WMI namespace ---------------------------------------------------------------------------
WMIManageSD.Wsf /WMINameSpace:Root\MyNameSpace /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:WBEM_ENABLE,WBEM_METHOD_EXECUTE,WBEM_WRITE_PROVIDER,WBEM_REMOTE_ACCESS /ACEFlags:CONTAINER_INHERIT_ACE /AddAce+
WMIManageSD.Wsf /WMINameSpace:Root\MyNameSpace /Trustee:BUILTIN\Administrators /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:WBEM_ENABLE,WBEM_METHOD_EXECUTE,WBEM_WRITE_PROVIDER,WBEM_REMOTE_ACCESS /ACEFlags:CONTAINER_INHERIT_ACE /AddAce+< SPAN class=875551814-02122005> >>Delet ing ACE in Security descriptors ...
>>Files and Folders (Rights) --------------------------------------------------------------
WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:REMOVE_ALL_ACE /DelAce+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:LissWareNET\MyUser /DelAce+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:BUILTIN\Administrators /DelAce+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+ /ADSI+ >>Files and Folders (Audit) ---------------------------------------------------------------
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:REMOVE_ALL_ACE /DelAce+ /SACL+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+ /SACL+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+ /SACL+
WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+ /SACL+ /ADSI+>>Share -----------------------------------------------------------------------------------
WMIManageSD.Wsf /Share:MyDirectory /Trustee:LissWareNET\MyUser /DelAce+
WMIManageSD.Wsf /Share:MyDirectory /Trustee:Everyone /DelAce+>>AD object (Rights) ----------------------------------------------------------------------
WMIManageSD.Wsf /ADObject:"user;CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:REMOVE_ALL_ACE /DelAce+
WMIManageSD.Wsf /ADObject:"user;CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+
WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+ /ADSI+>>AD object (Audit) -----------------------------------------------------------------------
WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /DelAce+>>Exchange 2000 mailbox -------------------------------------------------------------------
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+ /ADSI+
WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+ /E2KStore+>>Registry --------------------------------------------------------------------------------
WMIManageSD.Wsf /RegistryKey:HKLM\SOFTWARE\Microsoft /Trustee:LissWareNET\MyUser /DelAce+ /ADSI+>>WMI namespace ---------------------------------------------------------------------------
WMIManageSD.Wsf /WMINameSpace:Root\CIMv2 /Trustee:REMOVE_ALL_ACE /DelAce+
WMIManageSD.Wsf /WMINameSpace:Root\CIMv2 /Trustee:LissWareNET\MyUser /DelAce+
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Amy Hunter
Sent: Friday, December 02, 2005 2:17 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Exporting Mailbox rightsHi everyone,Thankyou everyone for your responses to my other post, everything went smoothly.I am looking for a way to expor t Exchange 2003 Mailbox Permission access to a .csv or .txt for all mailboxes in active directory
Does anyone know of a script or tool which will give me the same information as the Exchange Advanced Tab > Mailbox Rights for all users and groups.I want to view the mailboxes to see who has access to what.Kind Regards,Amy ;-)
How much free photo storage do you get? Store your holiday snaps for FREE with Yahoo! Photos. Get Yahoo! Photos
Play Santa's Celebrity Xmas Party, an exclusive game from Yahoo!
How much free photo storage do you get? Store your holiday snaps for FREE with Yahoo! Photos. Get Yahoo! Photos
Reply via email to