Click here to Skip to main content
Click here to Skip to main content

Adding File Access Permissions using DirectoryServices

, 27 Apr 2003
Rate this:
Please Sign up or sign in to vote.
How to add user to file access permissions using DirectoryServices in .NET framework in Active Directory


As the title of the article describes this article is going to describe a very simple but very helpful topic. Every now and then we are faced with a situation where we have to fix a file or folder's permissions to add or remove a user. The perfect example is installation of an ASP.Net application. If you have a folder in that application which needs write permissions for ASPNET user account then your custom installer may need to add a new ACE that gives ASPNET user the required permissions.

The Code

You can make use of DirectoryServices classes to accomplish this task. Technically speaking, the techniue does not use the classes defined in System.DirectoryServices namespace at all. It uses Interop to access ADSI objects to get the job done. The reason for using Interop is the same as we described in our earlier article, How to get file security information, DirectoryServices classes does not fully implement all the features present in ADSI.

using System;
using System.Collections;
using ActiveDs;

namespace PardesiServices.FixFilePermission
  class FileSecurity
    static void Main(string[] args)
        string strFile = @"D:\mmcInst.log";
            ADsSecurityUtilityClass secuUtil = new ADsSecurityUtilityClass();
            object ob = secuUtil.GetSecurityDescriptor(
            if (null != ob)
                ActiveDs.IADsSecurityDescriptor sd =<BR>                  (IADsSecurityDescriptor)ob;
                ActiveDs.IADsAccessControlList obDacl =
                bool bAddAce = true;
                IEnumerator obAceEnum = obDacl.GetEnumerator();
                while (obAceEnum.MoveNext())
                    IADsAccessControlEntry obAce =
                    Console.WriteLine("Trustee: {0}", obAce.Trustee);
                    // Check if "ASPNET" account is trustee of ACE or not.
                    if (obAce.Trustee.IndexOf("ASPNET") != -1)
                        // Check if this is a ALOWED Ace or not.
                        if (obAce.AceType ==<BR>                          (int)ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_ALLOWED)
                            bAddAce = false;

                // If bAddAce flag is set, then we will add it.
                if (bAddAce)
                    AccessControlEntryClass obNewAce =<BR>                      new AccessControlEntryClass();
                    obNewAce.AceType =<BR>                      (int)ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_ALLOWED;
                    obNewAce.Trustee = @"ASPNET";
                    obNewAce.AccessMask = -1;
                    sd.DiscretionaryAcl = obDacl;
            catch (Exception ex)

If you notice, at the top of the code we have referenced ActiveDs namespace. This namespace is included into the project by referencing to Active DS Type Library COM object in your project. If you use Visual Studio .NET IDE, then you can right click on the project and choose Add Reference menu option to add the required COM object refrence. If you are using command line compiler then use tlbimp utility to import activeds.tlb.


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Web Developer
United States United States
To learn more about us, Please visit us at

Comments and Discussions

GeneralMy vote of 1 Pinmembervsr.krishnamraju20-Apr-09 0:59 
QuestionFile access permissions Pinmemberluigilg29-May-06 6:00 
GeneralCode fails under windows server 2003 Pinmemberjaimi30-Jan-06 13:15 
GeneralNice code, but ignores issue of ordering PinsussSergei Gnezdov30-Sep-05 11:13 
General,Getting file permission Pinmemberfoxit14-Jul-05 12:22 is ripping off your article PinsussAnonymous23-Jun-05 11:16 
GeneralRe: is ripping off your article PinsussAnonymous23-Jun-05 11:18 
GeneralModifying File Access Permissions using Windows Scripting Host Pinmemberyrleu22-May-05 21:18 
GeneralSet Permissions Recursivelly PinsussRodrigo Vilar27-Apr-05 3:04 
Cool | :cool: I wrote a code like yours in my project, however I need to set the permissions to a whole tree of forders and files.
This task spend too much time... Do you know how to set the permissions into the root folder, and then it set the same permissions to its children?
Rodrigo Vilar Cool | :cool:
QuestionAsk a question? Pinmembereckel14-May-04 4:03 
GeneralActive Directory Client Not Installed PinmemberFeldsinc12-Dec-03 13:50 
GeneralRe: Active Directory Client Not Installed PinsussAnonymous12-May-04 6:48 
GeneralActive Directory Client Not Installed PinsussKevin Tran12-Dec-03 13:47 
GeneralRe: Active Directory Client Not Installed PinmemberMember 193192225-Jun-09 22:40 
GeneralADsSecurityUtilityClass Pinmemberjorj513-Jul-03 7:00 
GeneralRe: ADsSecurityUtilityClass PinmemberSoftomatix3-Jul-03 11:57 
GeneralRe: ADsSecurityUtilityClass Pinmemberjorj513-Jul-03 13:19 
GeneralRe: ADsSecurityUtilityClass Pinmemberversteijn12-Nov-03 9:47 
GeneralRe: ADsSecurityUtilityClass Pinmemberportyr24-Oct-03 2:07 
GeneralRe: ADsSecurityUtilityClass PinsussAnonymous11-Aug-05 1:51 
GeneralThe code is nice but... Pinmemberkbuchan5-May-03 7:18 
GeneralRe: The code is nice but... PinmemberSoftomatix7-May-03 6:48 
GeneralRe: The code is nice but... Pinmemberkbuchan7-May-03 7:00 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web03 | 2.8.150326.1 | Last Updated 28 Apr 2003
Article Copyright 2003 by Softomatix
Everything else Copyright © CodeProject, 1999-2015
Layout: fixed | fluid