Adding IIS_IUSRS with write permission to a directory programmatically

Question

I'm using Delphi 10.2 Tokyo, and I would like to add write permissions for the IIS_IUSRS user to a specific directory.

Are there any built-in functions in Delphi that I can use to do this?

If not, what are the Win32 API functions I must use?

There is nothing built in to Delphi for this. You can use `SetNamedSecurityInfo()` to update the directory's security descriptor with desired user permissions. — Remy Lebeau, Jul 06 '18 at 00:43

Paul Sanders · Answer 1 · 2019-05-01T12:05:46.240

8

Doing this programatically is a pain because of the complexity of the Windows security APIs, but there is an easier way, and that is to shell out to icacls and have that do the heavy lifting instead.

I don't know how you get Delphi to run a command line program but I imagine you can handle that bit, so a suitable command line is probably something like:

icacls MyFolder /grant "IIS_IUSRS:(OI)(CI)F"

This grants 'full access' to MyFolder and all who sail in her, and you can inspect exactly what effect this (or some other) command has actually had via the 'Security' tab in the Properties window for the folder in question in Explorer.

Other, more fine-grained permissions are possible, there's a useful post here:

How to grant permission to users for a directory using command line in Windows?

Happy ACL twiddling.

edited May 01 '19 at 12:05

answered Jul 06 '18 at 05:25

Paul Sanders

24,133
4
26
48

thanks Sanders, I thinks also that icalcs (icacls c:\toto /grant IIS_IUSRS:(OI)(CI)f /t /q for example) is the more easiest way. It's creasy that their is no equivalent api or made function (easy like using icacls) that can do this – zeus Jul 06 '18 at 06:22
1

Yes, a simpler API 'for the rest of us' would be very welcome. – Paul Sanders Jul 06 '18 at 06:24
Hmmm, comment on my own comment: come on Microsoft, give us the `icacls` command line syntax as an API. – Paul Sanders Jul 06 '18 at 07:10
1

In Powershell, this worked only if I included quotes around the part after /grant – Ciaran Gallagher May 01 '19 at 11:06
OK, thanks. It's probably because of the brackets. I will update my answer. – Paul Sanders May 01 '19 at 12:05

Adding IIS_IUSRS with write permission to a directory programmatically

1 Answers1