Click here to Skip to main content
14,297,447 members

Adding File Access Permissions using DirectoryServices

Rate this:
4.90 (18 votes)
Please Sign up or sign in to vote.
4.90 (18 votes)
27 Apr 2003
How to add user to file access permissions using DirectoryServices in .NET framework in Active Directory


As the title of the article describes this article is going to describe a very simple but very helpful topic. Every now and then we are faced with a situation where we have to fix a file or folder's permissions to add or remove a user. The perfect example is installation of an ASP.Net application. If you have a folder in that application which needs write permissions for ASPNET user account then your custom installer may need to add a new ACE that gives ASPNET user the required permissions.

The Code

You can make use of DirectoryServices classes to accomplish this task. Technically speaking, the techniue does not use the classes defined in System.DirectoryServices namespace at all. It uses Interop to access ADSI objects to get the job done. The reason for using Interop is the same as we described in our earlier article, How to get file security information, DirectoryServices classes does not fully implement all the features present in ADSI.

using System;
using System.Collections;
using ActiveDs;

namespace PardesiServices.FixFilePermission
  class FileSecurity
    static void Main(string[] args)
        string strFile = @"D:\mmcInst.log";
            ADsSecurityUtilityClass secuUtil = new ADsSecurityUtilityClass();
            object ob = secuUtil.GetSecurityDescriptor(
            if (null != ob)
                ActiveDs.IADsSecurityDescriptor sd =<BR>                  (IADsSecurityDescriptor)ob;
                ActiveDs.IADsAccessControlList obDacl =
                bool bAddAce = true;
                IEnumerator obAceEnum = obDacl.GetEnumerator();
                while (obAceEnum.MoveNext())
                    IADsAccessControlEntry obAce =
                    Console.WriteLine("Trustee: {0}", obAce.Trustee);
                    // Check if "ASPNET" account is trustee of ACE or not.
                    if (obAce.Trustee.IndexOf("ASPNET") != -1)
                        // Check if this is a ALOWED Ace or not.
                        if (obAce.AceType ==<BR>                          (int)ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_ALLOWED)
                            bAddAce = false;

                // If bAddAce flag is set, then we will add it.
                if (bAddAce)
                    AccessControlEntryClass obNewAce =<BR>                      new AccessControlEntryClass();
                    obNewAce.AceType =<BR>                      (int)ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_ALLOWED;
                    obNewAce.Trustee = @"ASPNET";
                    obNewAce.AccessMask = -1;
                    sd.DiscretionaryAcl = obDacl;
            catch (Exception ex)

If you notice, at the top of the code we have referenced ActiveDs namespace. This namespace is included into the project by referencing to Active DS Type Library COM object in your project. If you use Visual Studio .NET IDE, then you can right click on the project and choose Add Reference menu option to add the required COM object refrence. If you are using command line compiler then use tlbimp utility to import activeds.tlb.


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Web Developer
United States United States
To learn more about us, Please visit us at

Comments and Discussions

GeneralMy vote of 1 Pin
vsr.krishnamraju19-Apr-09 23:59
membervsr.krishnamraju19-Apr-09 23:59 
QuestionFile access permissions Pin
luigilg29-May-06 5:00
memberluigilg29-May-06 5:00 
GeneralCode fails under windows server 2003 Pin
jaimi30-Jan-06 12:15
memberjaimi30-Jan-06 12:15 
GeneralNice code, but ignores issue of ordering Pin
Sergei Gnezdov30-Sep-05 10:13
sussSergei Gnezdov30-Sep-05 10:13 
General,Getting file permission Pin
foxit14-Jul-05 11:22
memberfoxit14-Jul-05 11:22 is ripping off your article Pin
Anonymous23-Jun-05 10:16
memberAnonymous23-Jun-05 10:16 
GeneralRe: is ripping off your article Pin
Anonymous23-Jun-05 10:18
memberAnonymous23-Jun-05 10:18 
GeneralModifying File Access Permissions using Windows Scripting Host Pin
yrleu22-May-05 20:18
memberyrleu22-May-05 20:18 
GeneralSet Permissions Recursivelly Pin
rodrigovilar27-Apr-05 2:04
memberrodrigovilar27-Apr-05 2:04 
QuestionAsk a question? Pin
eckel14-May-04 3:03
membereckel14-May-04 3:03 
GeneralActive Directory Client Not Installed Pin
Feldsinc12-Dec-03 12:50
memberFeldsinc12-Dec-03 12:50 
GeneralRe: Active Directory Client Not Installed Pin
Anonymous12-May-04 5:48
memberAnonymous12-May-04 5:48 
GeneralActive Directory Client Not Installed Pin
Feldsinc12-Dec-03 12:47
memberFeldsinc12-Dec-03 12:47 
GeneralRe: Active Directory Client Not Installed Pin
Dahdread25-Jun-09 21:40
memberDahdread25-Jun-09 21:40 
GeneralADsSecurityUtilityClass Pin
jorj513-Jul-03 6:00
memberjorj513-Jul-03 6:00 
GeneralRe: ADsSecurityUtilityClass Pin
Softomatix3-Jul-03 10:57
memberSoftomatix3-Jul-03 10:57 
GeneralRe: ADsSecurityUtilityClass Pin
jorj513-Jul-03 12:19
memberjorj513-Jul-03 12:19 
GeneralRe: ADsSecurityUtilityClass Pin
versteijn12-Nov-03 8:47
memberversteijn12-Nov-03 8:47 
Softomatix wrote:
ADsSecurityUtilityClass is not supported on WIndows 2000 and earlier. It is only available on XP and Windows 2003.

Isn't it possible to add it? Like copying the ActiveX library to the system?


Freek Versteijn
GeneralRe: ADsSecurityUtilityClass Pin
portyr24-Oct-03 1:07
memberportyr24-Oct-03 1:07 
GeneralRe: ADsSecurityUtilityClass Pin
Anonymous11-Aug-05 0:51
memberAnonymous11-Aug-05 0:51 
GeneralThe code is nice but... Pin
kbuchan5-May-03 6:18
memberkbuchan5-May-03 6:18 
GeneralRe: The code is nice but... Pin
Softomatix7-May-03 5:48
memberSoftomatix7-May-03 5:48 
GeneralRe: The code is nice but... Pin
kbuchan7-May-03 6:00
memberkbuchan7-May-03 6:00 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Posted 26 Apr 2003


39 bookmarked