RegistrySecurity.RemoveAccessRuleAll(RegistryAccessRule) Metoda

Definicja

Przestrzeń nazw:

System.Security.AccessControl

Zestaw:

Microsoft.Win32.Registry.dll

Pakiet:

Microsoft.Win32.Registry v5.0.0

Wyszukuje wszystkie reguły kontroli dostępu z tym samym użytkownikiem i AccessControlType (zezwalaj lub odmawiaj) co określona reguła i, jeśli zostanie znaleziona, usunie je.

public:
 void RemoveAccessRuleAll(System::Security::AccessControl::RegistryAccessRule ^ rule);

public void RemoveAccessRuleAll (System.Security.AccessControl.RegistryAccessRule rule);

override this.RemoveAccessRuleAll : System.Security.AccessControl.RegistryAccessRule -> unit

Public Sub RemoveAccessRuleAll (rule As RegistryAccessRule)

Parametry

rule

RegistryAccessRule

Element RegistryAccessRule określający użytkownika i AccessControlType do wyszukania. Wszelkie prawa, flagi dziedziczenia lub flagi propagacji określone przez tę regułę są ignorowane.

Wyjątki

ArgumentNullException

rule to null.

Przykłady

Poniższy przykład kodu pokazuje, że RemoveAccessRuleAll metoda usuwa wszystkie reguły zgodne z użytkownikiem i AccessControlType, ignorując prawa i flagi.

W przykładzie tworzony jest RegistrySecurity obiekt i dodaje reguły, które zezwalają na różne prawa dla bieżącego użytkownika i odmawiają ich, z różnymi flagami dziedziczenia i propagacji. W tym przykładzie zostanie utworzona nowa reguła, która umożliwia bieżącemu użytkownikowi przejęcie na własność, i przekazanie tej reguły do RemoveAccessRuleAll metody w celu usunięcia dwóch reguł, które zezwalają na dostęp.

Uwaga

W tym przykładzie obiekt zabezpieczeń nie jest dołączany do RegistryKey obiektu. Zobacz metodę RegistryKey.GetAccessControl i metodę RegistryKey.SetAccessControl .

using System;
using System.Security.AccessControl;
using System.Security.Principal;
using System.Security;
using Microsoft.Win32;

public class Example
{
    public static void Main()
    {
        string user = Environment.UserDomainName + "\\"
            + Environment.UserName;

        // Create a security object that grants no access.
        RegistrySecurity mSec = new RegistrySecurity();

        // Add a rule that grants the current user the right
        // to read and enumerate the name/value pairs in a key, 
        // to read its access and audit rules, to enumerate
        // its subkeys, to create subkeys, and to delete the key. 
        // The rule is inherited by all contained subkeys.
        //
        RegistryAccessRule rule = new RegistryAccessRule(user, 
            RegistryRights.ReadKey | RegistryRights.WriteKey
                | RegistryRights.Delete, 
            InheritanceFlags.ContainerInherit, 
            PropagationFlags.None, 
            AccessControlType.Allow);
        mSec.AddAccessRule(rule);

        // Add a rule that allows the current user the right
        // right to set the name/value pairs in a key. 
        // This rule is inherited by contained subkeys, but
        // propagation flags limit it to immediate child 
        // subkeys.
        rule = new RegistryAccessRule(user, 
            RegistryRights.ChangePermissions,
            InheritanceFlags.ContainerInherit,
            PropagationFlags.InheritOnly | PropagationFlags.NoPropagateInherit, 
            AccessControlType.Allow);
        mSec.AddAccessRule(rule);

        // Add a rule that denies the current user the right
        // to set the name/value pairs in a key. This rule
        // has no inheritance or propagation flags, so it 
        // affects only the key itself.
        rule = new RegistryAccessRule(user,
            RegistryRights.SetValue,
            AccessControlType.Deny);
        mSec.AddAccessRule(rule);

        // Display the rules in the security object.
        ShowSecurity(mSec);

        // Create a rule that allows the current user the 
        // right to change the ownership of the key, with
        // no inheritance or propagation flags. The rights
        // and flags are ignored by RemoveAccessRuleAll,
        // and all rules that allow access for the current
        // user are removed.
        rule = new RegistryAccessRule(user, 
            RegistryRights.TakeOwnership, 
            AccessControlType.Allow);
        mSec.RemoveAccessRuleAll(rule);

        // Show that all rules that allow access have been 
        // removed.
        ShowSecurity(mSec);
    }

    private static void ShowSecurity(RegistrySecurity security)
    {
        Console.WriteLine("\r\nCurrent access rules:\r\n");

        foreach( RegistryAccessRule ar in 
            security.GetAccessRules(true, true, typeof(NTAccount)) )
        {
            Console.WriteLine("        User: {0}", ar.IdentityReference);
            Console.WriteLine("        Type: {0}", ar.AccessControlType);
            Console.WriteLine("      Rights: {0}", ar.RegistryRights);
            Console.WriteLine(" Inheritance: {0}", ar.InheritanceFlags);
            Console.WriteLine(" Propagation: {0}", ar.PropagationFlags);
            Console.WriteLine("   Inherited? {0}", ar.IsInherited);
            Console.WriteLine();
        }
    }
}

/* This code example produces output similar to following:

Current access rules:

        User: TestDomain\TestUser
        Type: Deny
      Rights: SetValue
 Inheritance: None
 Propagation: None
   Inherited? False

        User: TestDomain\TestUser
        Type: Allow
      Rights: SetValue, CreateSubKey, Delete, ReadKey
 Inheritance: ContainerInherit
 Propagation: None
   Inherited? False

        User: TestDomain\TestUser
        Type: Allow
      Rights: ChangePermissions
 Inheritance: ContainerInherit
 Propagation: NoPropagateInherit, InheritOnly
   Inherited? False


Current access rules:

        User: TestDomain\TestUser
        Type: Deny
      Rights: SetValue
 Inheritance: None
 Propagation: None
   Inherited? False

*/

Option Explicit
Imports System.Security.AccessControl
Imports System.Security.Principal
Imports System.Security
Imports Microsoft.Win32

Public Class Example

    Public Shared Sub Main()

        Dim user As String = Environment.UserDomainName _ 
            & "\" & Environment.UserName

        ' Create a security object that grants no access.
        Dim mSec As New RegistrySecurity()

        ' Add a rule that grants the current user the right
        ' to read and enumerate the name/value pairs in a key, 
        ' to read its access and audit rules, to enumerate
        ' its subkeys, to create subkeys, and to delete the key. 
        ' The rule is inherited by all contained subkeys.
        '
        Dim rule As New RegistryAccessRule(user, _
            RegistryRights.ReadKey Or RegistryRights.WriteKey _
                Or RegistryRights.Delete, _
            InheritanceFlags.ContainerInherit, _
            PropagationFlags.None, _
            AccessControlType.Allow)
        mSec.AddAccessRule(rule)

        ' Add a rule that allows the current user the right
        ' right to set the name/value pairs in a key. 
        ' This rule is inherited by contained subkeys, but
        ' propagation flags limit it to immediate child 
        ' subkeys.
        rule = New RegistryAccessRule(user, _
            RegistryRights.ChangePermissions, _
            InheritanceFlags.ContainerInherit, _
            PropagationFlags.InheritOnly Or PropagationFlags.NoPropagateInherit, _
            AccessControlType.Allow)
        mSec.AddAccessRule(rule)

        ' Add a rule that denies the current user the right
        ' to set the name/value pairs in a key. This rule
        ' has no inheritance or propagation flags, so it 
        ' affects only the key itself.
        rule = New RegistryAccessRule(user, _
            RegistryRights.SetValue, _
            AccessControlType.Deny)
        mSec.AddAccessRule(rule)

        ' Display the rules in the security object.
        ShowSecurity(mSec)

        ' Create a rule that allows the current user the 
        ' right to change the ownership of the key, with
        ' no inheritance or propagation flags. The rights
        ' and flags are ignored by RemoveAccessRuleAll,
        ' and all rules that allow access for the current
        ' user are removed.
        rule = New RegistryAccessRule(user, _
            RegistryRights.TakeOwnership, _
            AccessControlType.Allow)
        mSec.RemoveAccessRuleAll(rule)

        ' Show that all rules that allow access have been 
        ' removed.
        ShowSecurity(mSec)

    End Sub 

    Private Shared Sub ShowSecurity(ByVal security As RegistrySecurity)
        Console.WriteLine(vbCrLf & "Current access rules:" & vbCrLf)

        For Each ar As RegistryAccessRule In _
            security.GetAccessRules(True, True, GetType(NTAccount))

            Console.WriteLine("        User: {0}", ar.IdentityReference)
            Console.WriteLine("        Type: {0}", ar.AccessControlType)
            Console.WriteLine("      Rights: {0}", ar.RegistryRights)
            Console.WriteLine(" Inheritance: {0}", ar.InheritanceFlags)
            Console.WriteLine(" Propagation: {0}", ar.PropagationFlags)
            Console.WriteLine("   Inherited? {0}", ar.IsInherited)
            Console.WriteLine()
        Next

    End Sub
End Class 

'This code example produces output similar to following:
'
'Current access rules:
'
'        User: TestDomain\TestUser
'        Type: Deny
'      Rights: SetValue
' Inheritance: None
' Propagation: None
'   Inherited? False
'
'        User: TestDomain\TestUser
'        Type: Allow
'      Rights: SetValue, CreateSubKey, Delete, ReadKey
' Inheritance: ContainerInherit
' Propagation: None
'   Inherited? False
'
'        User: TestDomain\TestUser
'        Type: Allow
'      Rights: ChangePermissions
' Inheritance: ContainerInherit
' Propagation: NoPropagateInherit, InheritOnly
'   Inherited? False
'
'
'Current access rules:
'
'        User: TestDomain\TestUser
'        Type: Deny
'      Rights: SetValue
' Inheritance: None
' Propagation: None
'   Inherited? False
'

Uwagi

Bieżący RegistrySecurity element jest wyszukiwany pod kątem reguł, które mają tego samego użytkownika i taką samą AccessControlType wartość jak rule. Wszelkie prawa, flagi dziedziczenia lub flagi propagacji określone przez usługę rule są ignorowane podczas wykonywania tego wyszukiwania. Jeśli nie znaleziono pasujących reguł, nie zostanie podjęta żadna akcja.

Jeśli na przykład użytkownik ma wiele reguł, które zezwalają na różne prawa z różnymi flagami dziedziczenia i propagacji, możesz usunąć wszystkie te reguły, tworząc RegistryAccessRule obiekt określający użytkownika i AccessControlType.Allow, z dowolnymi prawami i flagami oraz przekazując tę regułę do RemoveAccessRuleAll metody.