| Downloads |
|---|
| 129552.zip |
Access-based enumeration (ABE) is a feature that first appeared in Windows Server 2003 SP1. In short, it prevents users from seeing files and directories they can't access when they navigate to a share. When ABE is disabled, users can see the existence of all files and folders when they open a share. If they try to open an item they don't have permission to access, they get an “access denied” message. In contrast, if ABE is enabled, the user simply doesn’t see the files and folders they don't have permission to access.
ABE is disabled by default in Windows Server 2003 but enabled by default in Windows Server 2008 and later. You can change that default using the Abecmd.exe command-line tool. However, this tool is missing an important functionality, so I created an alternative solution.
Abecmd.exe’s Downfall
Abecmd.exe is part of the Windows Server 2003 Access-Based Enumeration package. This Windows installer package also includes a white paper on ABE and an ABE GUI for Windows 2003. (Windows 2008 and later includes a built-in GUI that’s part of the Share and Storage Management console.)
With Abecmd.exe, you can easily enable or disable ABE on a computer’s shares on a case-by-case or global basis. However, you can’t view the ABE status for multiple shares on a computer at the same time. I’m perplexed as to why this functionality wasn’t included in the command-line tool. With this functionality, you could easily manage ABE on multiple shares because you could use a script to check each share’s status and change it if needed.
So, I created a solution that lets you easily manage ABE on multiple shares and even multiple computers. This solution consists of three components:
- ShareABE.exe. This command-line program can detect whether ABE is enabled, enable ABE, and disable ABE on a single share. When detecting ABE, it returns an exit code of 1 if ABE is enabled or 0 if it’s disabled. When you use it to enable or disable ABE, it returns an exit code of 0 to indicate success. Any other number indicates a failure. If a failure occurs, ShareABE.exe returns a real error code. For example, it returns an error code of 53 when the network path wasn’t found, 2310 when the share didn’t exist, and 5 when access was denied. You can use the Net Helpmsg command to check the error code.
- Get-ABE.ps1. This PowerShell script uses ShareABE.exe to detect whether ABE is enabled for one or more shares on one or more computers.
- Set-ABE.ps1. This PowerShell script uses ShareABE.exe to enable or disable ABE for one or more shares on one or more computers.
You must be a member of the Administrators group to change the ABE state. If you’re changing the ABE state for shares on the local computer, you must launch PowerShell or Cmd.exe under elevated permissions. To change ABE on a share for a remote computer, you must be a member of the Administrators group on the remote computer; elevation doesn’t matter in this case. If you aren’t a member of the Administrators group on the computer hosting the share, ShareABE.exe returns an error code of 5.
You can download this solution by going to the top of this page and click the Download the Code Here button. Besides including the two scripts and the command-line program, the 129552.zip file includes the program’s Free Pascal source code in case you’re curious.
The solution works on Server 2003 and later, and unlike Abecmd.exe, it even works on Windows 7. I have used the solution with NTFS shares. If you want to use ABE on DFS shares, see “How to implement Windows Server 2003 Access-Based Enumeration in a DFS Environment” or “How to enable Access-Based Enumeration for a Distributed File System (DFS) Share in Windows Server 2008".
To use the solution, copy ShareABE.exe, Get-ABE.ps1, and Set-ABE.ps1 to a directory in your Path (e.g., SystemRoot\system32). The scripts require PowerShell 2.0. If necessary, adjust the PowerShell script policy to enable scripts to run. I recommend using the RemoteSigned policy. (If you’re unfamiliar with the PowerShell policies, see "Running PowerShell Scripts Is as Easy as 1-2-3".)
ShareABE.exe
ShareABE.exe is the tool that makes the PowerShell scripts work. It's also useful as a standalone utility. To run it as a standalone utility, go to a Cmd.exe or PowerShell prompt and run the command
ShareABE ComputerName ShareName \\[Action\\]
where ComputerName is the name of the computer that hosts the share, ShareName is the share's name, and Action is either the word enable (to enable ABE) or disable (to disable it). If you omit the Action parameter, ShareABE.exe outputs whether ABE is enabled or disabled on the share.
Figure 1 shows ShareABE.exe in action. The first command shows that ABE is disabled for the share, and the second command enables ABE. The third command, which is the same as the first, shows that ABE is indeed enabled for the share.
Figure 1: Sample output from ShareABE.exe when run as a standalone utility
Get-ABE.ps1
Get-ABE.ps1 turns ShareABE.exe into a tool that can report the ABE status for multiple shares on multiple computers. Get-ABE.ps1's command-line syntax is
Get-ABE \\[-ComputerName String\\]
\\[-ShareName String\\[\\]\\]
(Although this command wraps here, you'd enter it all on one line in the PowerShell console. The same holds true for the other commands that wrap.) Both of the script's parameters, -ComputerName and -ShareName, are optional. If you omit -ComputerName, Get-ABE.ps1 assumes you want to check the shares on the local computer only. If you omit -ShareName, Get-ABE.ps1 assumes you want to check all the shares. The share name can contain wildcards. Here are some sample commands:
Get-ABE app1
This command reports on the ABE status of all shares on the server named app1. As this command and the following one show, including the parameters’ names (-ComputerName and -ShareName) is optional.
Get-ABE app1,app2,app3 Scan*
This command reports the ABE status for those shares whose names start with the word Scan on the app1, app2, and app3 servers.
Get-ABE.ps1 also accepts pipeline input for the -ComputerName parameter. For example, the command
Get-Content Servers.txt |
Get-ABE -ShareName Shares,Users
reports the ABE status of the shares named Shares and Users for each of the servers listed in the file Servers.txt (assuming one computer name per line).
Get-ABE.ps1's output consists of custom objects containing the computer name, the share name, the share's path, and a Boolean value (True or False) indicating whether ABE is enabled for the share. Figure 2 shows a sample of Get-ABE.ps1's output.
Figure 2: Sample output from Get-ABE.ps1
Set-ABE.ps1
Set-ABE.ps1 is similar to Get-ABE.ps1, except that it sets the ABE state for shares instead. Its command-line syntax is
Set-ABE \\[-ComputerName String\\[\\]\\]
-ShareName String\\[\\] \\[-Enable\\]
\\[-Disable\\] \\[-WhatIf\\] \\[-Confirm\\]
The -ComputerName parameter is optional. If you omit it, Set-ABE.ps1 assumes the local computer. The -ShareName parameter is required and supports wildcards. So, for example, if you want to enable or disable ABE for all shares, you’d use an asterisk (*) to match all share names. You must include either the -Enable or -Disable parameter (but not both). For testing purposes, Set-ABE.ps1 also supports the -WhatIf and -Confirm parameters. Here are some sample commands:
Set-ABE apps1 * -Enable
This command enables ABE for all shares on apps1. This example omits the parameters’ names
(-ComputerName and -ShareName) because both parameters are present on the command line in the order specified by the syntax.
Set-ABE apps1,apps2,apps3 Users -Disable
This command disables ABE for the Users share on the apps1, apps2, and apps3 servers.
Like Get-ABE.ps1, Set-ABE.ps1 supports pipeline input for computer names. For example, the command
Get-Content Servers.txt |
Set-ABE -ShareName Dep* -Enable
enables ABE for those shares starting with Dep on each server listed in the Servers.txt file (assuming one computer name per line). Figure 3 shows Set-ABE.ps1 in action, including the -Confirm parameter.
Figure 3: Sample output from Set-ABE.ps1
Take Control of ABE
ABE is a helpful tool in the administrator's toolkit, but it lacks a flexible, scriptable administration interface. ShareABE.exe, Get-ABE.ps1, and Set-ABE.ps1 rectify this shortcoming and make it possible to detect, enable, and disable ABE on multiple shares and on multiple computers.
