Getting permissions of a remote SMB/CIFS share without remote powershell or WMI-CodePudding

I'm looking for a way to export the ACL of a SMB / CIFS share (not to be confused with the NTFS ACL) from a Windows machine connected to the share. So far, I can see the permissions in the advanced security properties of the share, but no way to export or parse them short of an AutoIT monstrosity.

I want to obtain this information in a format that I can parse, be it CSV, JSON, XML, etc.

I have checked this question which recommends using Powershell's Get-SmbShareAccess: Retrieving Remote File Share 'Share Permissions' Using Powershell and this TechNet question which uses Get-WmiObject: Get-wmiobject Win32_Share does not show Sharing Permissions but both assume we can get Powershell code executed on the server hosting the share: this isn't the case for me as the share is not hosted on windows and I don't have shell access to the machine.

I'm open to any language but would prefer Powershell if given the choice.

CodePudding user response：

Windows explorer uses RPC via the win32 API method NetShareGetInfo(), but it's not easy to call it directly from Powershell.

FileShareUtils is a fantastic gallery module that does all of this for you, and the best option that I could find:

$share = Get-NetShare -Name 'MyShare' -Server 'MyFileServer01'

Server              : MyServer01
Name                : MyShare
Path                : E:\Folder\Path
Description         : 
ABE                 : Enabled
CachingMode         : Manual
ShareACLText        : BUILTIN\Administrators|FullControl,Everyone|FullControl
CurrentUses         : 4
ConcurrentUserLimit : -1
BranchCache         : Disabled
Flags               : 2051
Type                : Disk Drive
ShareSDDL           : D:(A;;FA;;;WD)(A;;FA;;;BA)
ShareACL            : System.Security.AccessControl.DirectorySecurity

$share.ShareACL.Access


FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : Everyone
IsInherited       : False
InheritanceFlags  : None
PropagationFlags  : None

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrators
IsInherited       : False
InheritanceFlags  : None
PropagationFlags  : None

I was not able to test whether the whole Get-NetShare works as a non-admin user, but if you can see the "Share" permissions in file explorer, then this should work for you. If do you still get access-denied messages, then you may be able to work your way through the module code and see where/why.