Information
The topic you requested is included in another documentation set. For convenience, it's displayed below. Choose Switch to see the topic in its original location.

Directory::SetAccessControl Method

Applies access control list (ACL) entries described by a DirectorySecurity object to the specified directory.

Namespace:  System.IO
Assembly:  mscorlib (in mscorlib.dll)

public:
static void SetAccessControl(
	String^ path, 
	DirectorySecurity^ directorySecurity
)

Parameters

path
Type: System::String
A directory to add or remove access control list (ACL) entries from.
directorySecurity
Type: System.Security.AccessControl::DirectorySecurity
A DirectorySecurity object that describes an ACL entry to apply to the directory described by the path parameter.

ExceptionCondition
ArgumentNullException

The directorySecurity parameter is nullptr.

DirectoryNotFoundException

The directory could not be found.

ArgumentException

The path was invalid.

UnauthorizedAccessException

The current process does not have access to the directory specified by path.

-or-

The current process does not have sufficient privilege to set the ACL entry.

PlatformNotSupportedException

The current operating system is not Windows 2000 or later.

The SetAccessControl method applies access control list (ACL) entries to a file that represents the noninherited ACL list.

Caution noteCaution

The ACL specified for the directorySecurity parameter replaces the existing ACL for the directory. To add permissions for a new user, use the GetAccessControl method to obtain the existing ACL and modify it.

An ACL describes individuals and/or groups who have, or do not have, rights to specific actions on the given file or directory. For more information, see ACL Technology Overview and How to: Add or Remove Access Control List Entries.

The SetAccessControl method persists only DirectorySecurity objects that have been modified after object creation.  If a DirectorySecurity object has not been modified, it will not be persisted to a file.  Therefore, it is not possible to retrieve a DirectorySecurity object from one file and reapply the same object to another file.

To copy ACL information from one file to another:

  1. Use the GetAccessControl method to retrieve the DirectorySecurity object from the source file.

  2. Create a new DirectorySecurity object for the destination file.

  3. Use the GetSecurityDescriptorBinaryForm or GetSecurityDescriptorSddlForm method of the source DirectorySecurity object to retrieve the ACL information.

  4. Use the SetSecurityDescriptorBinaryForm or SetSecurityDescriptorSddlForm method to copy the information retrieved in step 3 to the destination DirectorySecurity object.

  5. Set the destination DirectorySecurity object to the destination file using the SetAccessControl method.

In NTFS environments, ReadAttributes and ReadExtendedAttributes are granted to the user if the user has ListDirectory rights on the parent folder. To deny ReadAttributes and ReadExtendedAttributes, deny ListDirectory on the parent directory.

The following code example uses the GetAccessControl and the SetAccessControl methods to add an access control list (ACL) entry and then remove an ACL entry from a directory. You must supply a valid user or group account to run this example.


using namespace System;
using namespace System::IO;
using namespace System::Security::AccessControl;

// Adds an ACL entry on the specified directory for the
// specified account.
void AddDirectorySecurity(String^ directoryName, String^ account, 
     FileSystemRights rights, AccessControlType controlType)
{
    // Create a new DirectoryInfo object.
    DirectoryInfo^ dInfo = gcnew DirectoryInfo(directoryName);

    // Get a DirectorySecurity object that represents the
    // current security settings.
    DirectorySecurity^ dSecurity = dInfo->GetAccessControl();

    // Add the FileSystemAccessRule to the security settings.
    dSecurity->AddAccessRule( gcnew FileSystemAccessRule(account,
        rights, controlType));

    // Set the new access settings.
    dInfo->SetAccessControl(dSecurity);
}

// Removes an ACL entry on the specified directory for the
// specified account.
void RemoveDirectorySecurity(String^ directoryName, String^ account,
     FileSystemRights rights, AccessControlType controlType)
{
    // Create a new DirectoryInfo object.
    DirectoryInfo^ dInfo = gcnew DirectoryInfo(directoryName);

    // Get a DirectorySecurity object that represents the
    // current security settings.
    DirectorySecurity^ dSecurity = dInfo->GetAccessControl();

    // Add the FileSystemAccessRule to the security settings.
    dSecurity->RemoveAccessRule(gcnew FileSystemAccessRule(account,
        rights, controlType));

    // Set the new access settings.
    dInfo->SetAccessControl(dSecurity);
}    

int main()
{
    String^ directoryName = "TestDirectory";
    String^ accountName = "MYDOMAIN\\MyAccount";
    if (!Directory::Exists(directoryName))
    {
        Console::WriteLine("The directory {0} could not be found.", 
            directoryName);
        return 0;
    }
    try
    {
        Console::WriteLine("Adding access control entry for {0}",
            directoryName);

        // Add the access control entry to the directory.
        AddDirectorySecurity(directoryName, accountName,
            FileSystemRights::ReadData, AccessControlType::Allow);

        Console::WriteLine("Removing access control entry from {0}",
            directoryName);

        // Remove the access control entry from the directory.
        RemoveDirectorySecurity(directoryName, accountName, 
            FileSystemRights::ReadData, AccessControlType::Allow);

        Console::WriteLine("Done.");
    }
    catch (UnauthorizedAccessException^)
    {
        Console::WriteLine("You are not authorised to carry" +
            " out this procedure.");
    }
    catch (System::Security::Principal::
        IdentityNotMappedException^)
    {
        Console::WriteLine("The account {0} could not be found.", accountName);
    }
}



.NET Framework

Supported in: 4, 3.5, 3.0, 2.0

.NET Framework Client Profile

Supported in: 4, 3.5 SP1

  • FileIOPermission 

    for permission to enumerate access control list (ACL) for a directory. Associated enumerations: NoAccess , View

    Security action: Demand.

Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows XP SP2 x64 Edition, Windows Server 2008 (Server Core not supported), Windows Server 2008 R2 (Server Core supported with SP1 or later), Windows Server 2003 SP2

The .NET Framework does not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.

Community Additions

Show:
© 2014 Microsoft