Jira (PUP-6729) NTFS permissions should be recalculated given SYSTEM is an implicit member of local Administrators

[Russell Mull (JIRA)]

Title: Message Title

Russell Mull commented on PUP-6729   Re: NTFS permissions should be recalculated given SYSTEM is an implicit member of local Administrators From a different system, which is much fresher, but showing the same issue. In this case, it's trying to copy into clientbucket/9/e/: PS C:\ProgramData\PuppetLabs\puppet\cache> Get-Acl . | select * Get-Acl . | select *     PSPath : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet PSChildName : cache PSDrive : C PSProvider : Microsoft.PowerShell.Core\FileSystem CentralAccessPolicyId : CentralAccessPolicyName : Path : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache Owner : QMZMML8VXJ0JTSW\Administrator Group : QMZMML8VXJ0JTSW\None Access : {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule...} Sddl : O:LAG:S-1-5-21-1327426001-2876377404-380743070-513D:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A; ID;FA;;;LA)(A;OICIIOID;GA;;;CO)(A;OICIID;0x1200a9;;;BU)(A;CIID;DCLCRPCR;;;BU) AccessToString : NT AUTHORITY\SYSTEM Allow FullControl BUILTIN\Administrators Allow FullControl QMZMML8VXJ0JTSW\Administrator Allow FullControl CREATOR OWNER Allow 268435456 BUILTIN\Users Allow ReadAndExecute, Synchronize BUILTIN\Users Allow Write AuditToString : AccessRightType : System.Security.AccessControl.FileSystemRights AccessRuleType : System.Security.AccessControl.FileSystemAccessRule AuditRuleType : System.Security.AccessControl.FileSystemAuditRule AreAccessRulesProtected : False AreAuditRulesProtected : False AreAccessRulesCanonical : True PS C:\ProgramData\PuppetLabs\puppet\cache\clientbucket> Get-Acl . | select * Get-Acl . | select *     PSPath : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache\clientbucket PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache PSChildName : clientbucket PSDrive : C PSProvider : Microsoft.PowerShell.Core\FileSystem CentralAccessPolicyId : CentralAccessPolicyName : Path : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache\clientbucket Owner : BUILTIN\Administrators Group : NT AUTHORITY\SYSTEM Access : {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule...} Sddl : O:BAG:SYD:PAI(A;;0x120080;;;WD)(A;CIIO;FA;;;CO)(A;OIIO;0x1f01df;;;CO)(A;OIIO;FR;;;CG)(A;CIIO; 0x1200a9;;;CG)(A;;0x1200a9;;;SY)(A;;FA;;;BA) AccessToString : Everyone Allow ReadAttributes, ReadPermissions, Synchronize CREATOR OWNER Allow FullControl CREATOR OWNER Allow DeleteSubdirectoriesAndFiles, Write, Delete, Read, ChangePermissions, TakeOwnership, Synchronize CREATOR GROUP Allow Read, Synchronize CREATOR GROUP Allow ReadAndExecute, Synchronize NT AUTHORITY\SYSTEM Allow ReadAndExecute, Synchronize BUILTIN\Administrators Allow FullControl AuditToString : AccessRightType : System.Security.AccessControl.FileSystemRights AccessRuleType : System.Security.AccessControl.FileSystemAccessRule AuditRuleType : System.Security.AccessControl.FileSystemAuditRule AreAccessRulesProtected : True AreAuditRulesProtected : False AreAccessRulesCanonical : True AreAuditRulesCanonical : True PS C:\ProgramData\PuppetLabs\puppet\cache\clientbucket\9> Get-Acl . | select * Get-Acl . | select *     PSPath : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache\clientbucket\9 PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache\clientbucket PSChildName : 9 PSDrive : C PSProvider : Microsoft.PowerShell.Core\FileSystem CentralAccessPolicyId : CentralAccessPolicyName : Path : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache\clientbucket\9 Owner : QMZMML8VXJ0JTSW\Administrator Group : QMZMML8VXJ0JTSW\None Access : {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule...} Sddl : O:LAG:S-1-5-21-1327426001-2876377404-380743070-513D:AI(A;ID;FA;;;LA)(A;CIIOID;FA;;;CO)(A;ID;0 x1200a9;;;S-1-5-21-1327426001-2876377404-380743070-513)(A;CIIOID;0x1200a9;;;CG)(A;OIIOID;0x1f 01df;;;CO)(A;OIIOID;FR;;;CG) AccessToString : QMZMML8VXJ0JTSW\Administrator Allow FullControl CREATOR OWNER Allow FullControl QMZMML8VXJ0JTSW\None Allow ReadAndExecute, Synchronize CREATOR GROUP Allow ReadAndExecute, Synchronize CREATOR OWNER Allow DeleteSubdirectoriesAndFiles, Write, Delete, Read, ChangePermissions, TakeOwnership, Synchronize CREATOR GROUP Allow Read, Synchronize AuditToString : AccessRightType : System.Security.AccessControl.FileSystemRights AccessRuleType : System.Security.AccessControl.FileSystemAccessRule AuditRuleType : System.Security.AccessControl.FileSystemAuditRule AreAccessRulesProtected : False AreAuditRulesProtected : False AreAccessRulesCanonical : True AreAuditRulesCanonical : True for reference, the 'e' directory next to (not under) '9': PS C:\ProgramData\PuppetLabs\puppet\cache\clientbucket\e> Get-Acl . | select * Get-Acl . | select *     PSPath : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache\clientbucket\e PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache\clientbucket PSChildName : e PSDrive : C PSProvider : Microsoft.PowerShell.Core\FileSystem CentralAccessPolicyId : CentralAccessPolicyName : Path : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\PuppetLabs\puppet\cache\clientbucket\e Owner : BUILTIN\Administrators Group : NT AUTHORITY\SYSTEM Access : {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule...} Sddl : O:BAG:SYD:AI(A;ID;FA;;;BA)(A;CIIOID;FA;;;CO)(A;ID;0x1200a9;;;SY)(A;CIIOID;0x1200a9;;;CG)(A;OI IOID;0x1f01df;;;CO)(A;OIIOID;FR;;;CG) AccessToString : BUILTIN\Administrators Allow FullControl CREATOR OWNER Allow FullControl NT AUTHORITY\SYSTEM Allow ReadAndExecute, Synchronize CREATOR GROUP Allow ReadAndExecute, Synchronize CREATOR OWNER Allow DeleteSubdirectoriesAndFiles, Write, Delete, Read, ChangePermissions, TakeOwnership, Synchronize CREATOR GROUP Allow Read, Synchronize AuditToString : AccessRightType : System.Security.AccessControl.FileSystemRights AccessRuleType : System.Security.AccessControl.FileSystemAccessRule AuditRuleType : System.Security.AccessControl.FileSystemAuditRule AreAccessRulesProtected : False AreAuditRulesProtected : False AreAccessRulesCanonical : True AreAuditRulesCanonical : True Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.