如何重置和刪除帳戶的ACL權限？

Question

操作系統Windows 7 SP1 64位

我設置ACL權限的文件夾我的一些帳戶：

var accessRule = new FileSystemAccessRule(account, 
    fileSystemRights: FileSystemRights.Modify, 
    inheritanceFlags: InheritanceFlags.ContainerInherit | 
    InheritanceFlags.ObjectInherit, 
    propagationFlags: PropagationFlags.None, 
    type: AccessControlType.Allow); 

// Get a DirectorySecurity object that represents the 
// current security settings. 
DirectorySecurity dSecurity = directoryinfo.GetAccessControl(); 

// Add the FileSystemAccessRule to the security settings. 
dSecurity.AddAccessRule(accessRule); 

// Set the new access settings. 
directoryinfo.SetAccessControl(dSecurity); 

在這種情況下，我允許讀取和寫入帳戶。它工作正常。

但後來我想更改該帳戶的權限：允許只讀權限。我使用這樣的代碼：

var accessRule = new FileSystemAccessRule(account, 
    fileSystemRights: FileSystemRights.ReadAndExecute, 
    inheritanceFlags: InheritanceFlags.ContainerInherit | 
    InheritanceFlags.ObjectInherit, 
    propagationFlags: PropagationFlags.None, 
    type: AccessControlType.Allow); 

// Get a DirectorySecurity object that represents the 
// current security settings. 
DirectorySecurity dSecurity = directoryinfo.GetAccessControl(); 

// Add the FileSystemAccessRule to the security settings. 
dSecurity.AddAccessRule(accessRule); 

// Set the new access settings. 
directoryinfo.SetAccessControl(dSecurity); 

但該帳戶仍具有寫入權限。我該如何解決它？另外，如果我稍後想要這樣做，我該如何刪除該帳戶的ACL權限？

Answer 1

這是很容易：

dSecurity = directoryinfo.GetAccessControl(); 

accessRule = new FileSystemAccessRule(account, 
    fileSystemRights: FileSystemRights.ReadAndExecute, 
    inheritanceFlags: InheritanceFlags.ContainerInherit | 
    InheritanceFlags.ObjectInherit, 
    propagationFlags: PropagationFlags.None, 
    type: AccessControlType.Allow); 

dSecurity.SetAccessRule(accessRule); 
directoryinfo.SetAccessControl(dSecurity); 

和去除：

dSecurity = directoryinfo.GetAccessControl(); 

accessRule = new FileSystemAccessRule(account, 0, 0); 
dSecurity.RemoveAccessRuleAll(accessRule); 
directoryinfo.SetAccessControl(dSecurity); 

注意，如果沒有爲account沒有訪問規則SetAccessRule會甚至工作（因此它甚至可以用來做最初的Add）