如何通过域管理员账号在VB.NET中修改文件访问规则

要在当前User1登录会话中，用SuperUser权限修改文件的访问规则，核心是实现Windows用户身份模拟——让后续的文件操作以SuperUser的身份执行，而不是仅仅创建AD连接。你的现有代码只建立了AD目录条目，但没有利用该身份执行实际的文件ACL修改操作，以下是完整的实现方案：

关键实现步骤 #

1. 编写身份模拟的辅助类，调用Windows API实现用户身份的临时切换
2. 在模拟SuperUser身份的上下文中，执行文件ACL的添加/移除操作
3. 操作完成后立即取消模拟，恢复原用户身份

完整代码示例 #

身份模拟辅助类 #

Imports System.Security.Principal
Imports System.Runtime.InteropServices

Public Class ImpersonationHelper
    Private Const LOGON32_LOGON_INTERACTIVE As Integer = 2
    Private Const LOGON32_PROVIDER_DEFAULT As Integer = 0

    Private _impersonationContext As WindowsImpersonationContext

    <DllImport("advapi32.dll", SetLastError:=True, CharSet:=CharSet.Unicode)>
    Private Shared Function LogonUser(lpszUsername As String,
                                     lpszDomain As String,
                                     lpszPassword As String,
                                     dwLogonType As Integer,
                                     dwLogonProvider As Integer,
                                     ByRef phToken As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll", CharSet:=CharSet.Auto)>
    Private Shared Function CloseHandle(hObject As IntPtr) As Boolean
    End Function

    Public Function ImpersonateUser(username As String, domain As String, password As String) As Boolean
        Dim tokenHandle As IntPtr = IntPtr.Zero
        Dim returnValue As Boolean = LogonUser(username, domain, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, tokenHandle)

        If returnValue Then
            Dim newId As New WindowsIdentity(tokenHandle)
            _impersonationContext = newId.Impersonate()
            CloseHandle(tokenHandle)
            Return True
        Else
            Return False
        End If
    End Function

    Public Sub UndoImpersonation()
        _impersonationContext?.Undo()
    End Sub
End Class

修改文件ACL的主逻辑 #

Imports System.IO
Imports System.Security.AccessControl

Try
    Dim strUSER As String = "superuser"
    Dim strPASSWORD As String = "qwerty123456"
    Dim strDOMAIN As String = System.Net.NetworkInformation.IPGlobalProperties.GetIPGlobalProperties().DomainName

    Dim impersonator As New ImpersonationHelper()
    If impersonator.ImpersonateUser(strUSER, strDOMAIN, strPASSWORD) Then
        Try
            Dim fileName As String = "Z:\Data\Letters\Out\123.pdf"
            Console.WriteLine($"为文件 {fileName} 添加访问控制条目")

            ' 添加User2的写入权限
            AddFileSecurity(fileName, $"{strDOMAIN}\user2", FileSystemRights.Write, AccessControlType.Allow)

            Console.WriteLine($"从文件 {fileName} 移除访问控制条目")
            ' 移除User2的写入权限（示例）
            RemoveFileSecurity(fileName, $"{strDOMAIN}\user2", FileSystemRights.Write, AccessControlType.Allow)
        Finally
            ' 必须取消模拟，恢复原用户身份
            impersonator.UndoImpersonation()
        End Try
    Else
        Throw New Exception("无法模拟SuperUser身份，请检查凭据是否正确")
    End If

Catch e As Exception
    MsgBox($"操作失败：{e.Message}")
End Try

' 添加文件权限的辅助方法
Private Sub AddFileSecurity(filePath As String, account As String, rights As FileSystemRights, controlType As AccessControlType)
    Dim fileInfo As New FileInfo(filePath)
    Dim fSecurity As FileSecurity = fileInfo.GetAccessControl()

    ' 添加新的访问规则
    fSecurity.AddAccessRule(New FileSystemAccessRule(account, rights, InheritanceFlags.None, PropagationFlags.NoPropagateInherit, controlType))

    ' 应用修改
    fileInfo.SetAccessControl(fSecurity)
End Sub

' 移除文件权限的辅助方法
Private Sub RemoveFileSecurity(filePath As String, account As String, rights As FileSystemRights, controlType As AccessControlType)
    Dim fileInfo As New FileInfo(filePath)
    Dim fSecurity As FileSecurity = fileInfo.GetAccessControl()

    ' 移除指定的访问规则
    fSecurity.RemoveAccessRule(New FileSystemAccessRule(account, rights, InheritanceFlags.None, PropagationFlags.NoPropagateInherit, controlType))

    ' 应用修改
    fileInfo.SetAccessControl(fSecurity)
End Sub

注意事项 #

• 安全提示：硬编码密码存在安全风险，建议通过安全方式（如配置文件、密钥管理服务）获取凭据
• 网络共享权限：确保SuperUser对Z盘对应的网络共享有足够的访问权限
• 权限继承：如果需要修改继承的权限，调整InheritanceFlags和PropagationFlags参数即可

内容的提问来源于stack exchange，提问作者Sergio Italiano