c# - Using System.Security.AccessControl to remove an ACE from a folder ACL is very slow if the target folder size is very large -
i need remove accounts (like "everyone" trustee or global group giving access folder) acl on particular subfolder of share. directorysecurity object, , loop through authorizationrulecollection, remove accessrule in question acl, , call setaccesscontrol apply changes. works fine if target folder small, if has lot of child folders , files, can take forever apply changes (much longer manually). want deal acl on target folder. there way using .net directorysecurity classes? or have resort win32 api or other solution? thanks.
here snippet of code. call dirinfo.setaccesscontrol(dirsec) hangs when folder size large.
directoryinfo dirinfo = new directoryinfo(path); directorysecurity dirsec = dirinfo.getaccesscontrol(); authorizationrulecollection acl = dirsec.getaccessrules(true, true, typeof(system.security.principal.ntaccount)); foreach (filesystemaccessrule ace in acl) { if (groupstoremove.contains(ace.identityreference.value)) { dirsec.removeaccessrulespecific(ace); dirinfo.setaccesscontrol(dirsec); } }
directoryinfo dirinfo = new directoryinfo(path); directorysecurity dirsec = dirinfo.getaccesscontrol(); authorizationrulecollection acl = dirsec.getaccessrules(true, true, typeof(system.security.principal.ntaccount)); foreach (filesystemaccessrule ace in acl) { if (groupstoremove.contains(ace.identityreference.value)) { dirsec.removeaccessrulespecific(ace); dirinfo.setaccesscontrol(dirsec); } }
in code, applying updates acl every interation of loop, gets expensive. have tried moving dirinfo.setaccesscontrol(dirsec);
outside foreach
? should invoke setaccesscontrol
method on directoryinfo
object once, applying changes in 1 pass, this:
foreach (filesystemaccessrule ace in acl) { if (groupstoremove.contains(ace.identityreference.value)) { dirsec.removeaccessrulespecific(ace); } } dirinfo.setaccesscontrol(dirsec);
Comments
Post a Comment