Check if a user can read a file on a UNC-Share

Question

A User on our Windows Client has a function to send Links to Files on our Network-Shares (UNC-Paths) to other Users in our Company.

Often these Users does not know if the receipients have access to this Share.

A trial and error strategy is not possible because the users that is sending the link is already connected to this share with his/her rights.

So it seems to be the only possible to use API-Calls to check if the receipients have access, does anybody how to manage this?

I only need a meta-code, i have to translate this to lotus script (i dont think anybody solved this problem in lotus script)

Answer 1

In theory, you just need to make a call to some Windows "function" that can answer the question, what access rights does this user have to this file. The only API I could find that provides this information (and is used by the Windows ACL Editor and its Effective Permissions feature, is the GetEffectiveRightsFromAcl function.

However, using it involves some complicated, low-level programming in C. It is also unreliable, as stated in Microsoft KB article #262278:

Due to these limitations, the GetEffectiveRightsFromAcl API should not be used except for situations where you can be certain that the context is such that any overriding user rights or privileges are not pertinent, and the target object is not secured by granting or denying access to any pseudo-groups. Generally, accurate access information for a given user and securable object can only be retrieved through the AccessCheck function, which requires an access token for the user logon.

Assuming that's not a problem in your environment, you may benefit from a project hosted on codeproject.com that has wrapped the low-level code in a higher-level COM object. The project is called UserAccessCheck and you could access it like any other COM object from LotusScript:

Dim hasWriteAccess as Variant
Dim obNet as Variant

obNet = CreateObject("Pardesi.TrusteeUtil")

hasWriteAccess = obNet.CheckPermissionsOnFile("foo", "bar", "C:\\DataFiles", 0x0002)
Msgbox(hasWriteAccess)

I haven't tried this myself, but this is where I'd start.