Mastering Windows PowerShell Scripting - Third Edition

Getting a security descriptor

When Get-Acl is used, the object that it gets is a security descriptor. The security descriptor includes a set of control information (ownership, and so on), along with the discretionary and system access control lists.

The WMI class Win32_LogicalShareSecuritySetting is used to represent the security for each of the shares on a computer:

$security = Get-CimInstance Win32_LogicalShareSecuritySetting -Filter "Name='WmiPerms'" 

The security settings object can be used to retrieve a security descriptor by calling the GetSecurityDescriptor method:

$return = $security | Invoke-CimMethod -MethodName GetSecurityDescriptor 
$aclObject = $return.Descriptor 

The security descriptor held in the aclObject variable is very ...