本帖最后由 pusofalse 于 2012-4-27 23:29 编辑
只要令牌中还有恢复(SeRestoreName)和取得所有者(SeTakeOwnershipName)的特权,权限什么的都可以无视,一般管理员用户的令牌中总是有这两个特权。
如果手动修改,先将所有者改为Administrators,再重新打开安全属性页修改Everyone为完全控制,并继承到所有子对象,这样就可以删除了。AU3代码:
#include <lsasecur.au3>
Const $sFilePath = @ScriptDir & "\test\"
Local $aPriv[2][2] = [[$SE_RESTORE_PRIV, $SE_PRIV_ENABLED], [$SE_TAKE_OWNERSHIP_PRIV, $SE_PRIV_ENABLED]]
Local $hToken = _SeOpenProcessToken(-1)
_SeAdjustTokenPrivs($hToken, $aPriv)
_SeCloseHandle($hToken)
Local $pTrustee = _SeLookupAccountName("Everyone")
Local $pDacl = _SeSetEntriesInAcl1($pTrustee, $SE_GENERIC_ALL, $SE_GRANT_ACCESS, BitOR($SE_OBJECT_INHERIT_ACE, $SE_CONTAINER_INHERIT_ACE, $SE_NO_PROPAGATE_INHERIT_ACE))
Local $pSecurity = _SeInitSecurityDescriptor()
_SeSetSecurityDescriptorDacl($pSecurity, $pDacl)
_SeSetSecurityDescriptorOwner($pSecurity, $pTrustee)
If _SeSetFileSecurity($sFilePath, $SE_INFO_OWNER, $pSecurity) Then
If _SeSetFileSecurity($sFilePath, $SE_INFO_DACL, $pSecurity) Then
MsgBox(48, "OK", _SeFormatMsg("", 0))
Else
MsgBox(48, "Error", _SeFormatMsg("Setting DACL"))
EndIf
Else
MsgBox(48, "Error", _SeFormatMsg("Setting Owner"))
EndIf
_SeHeapFree($pSecurity)
_SeHeapFree($pTrustee)
_SeLocalFree($pDacl)
|