UnauthorizedAcccesException on DirectorySecurity.SetAccesesControl when user has full control

Question

I have a C# console app that is creating a directory and then attempting to give modify access for the directory to domain users. The application has been working fine for a long time but all of a sudden it has started to throw an UnauthorizedAcccesException on the DirectorySecurity.SetAccessControl method.

I've gotten the current user account using WindowsIdentity.GetCurrent and confirmed that it is the account that I expect (it impersonates a power user because the logged-in user wont have enough access). I've checked the permissions for the power user on the directory that is created and they have full control.

private DirectoryInfo CreateFolderWithOpenAccess(string directoryPath)
{
  DirectoryInfo directory = Directory.CreateDirectory(directoryPath);
  DirectorySecurity directorySecurity = directory.GetAccessControl();

  if (!HasModifyAccess(directory))
  {
    directorySecurity.AddAccessRule(
      new FileSystemAccessRule(
        Settings.Default.DomainUsers, 
        FileSystemRights.Modify,
        InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
        PropagationFlags.None, 
        AccessControlType.Allow
      )
    );

    directory.SetAccessControl(directorySecurity);
  }

  return directory;
}

Does anyone have any suggestions on what I should check to make sure that I'm not missing anything? Any alternative ways of doing this?

Answer 1

I checked with the guys in our IT department and they reminded me that the folder that I was creating was being accessed using a network file share. It turns out that even though the account had 'Full Control' permissions to all the files and folders in the share it was not getting access to change permissions because it didn't have 'Full Control' permission at the share level. The cause of this was the shuffling of folders on our data server where one of the IT dudes recreated the share but didn't recreate the 'Full Control' permission for the account. The share permissions can be found by:

1. Opening the properties for the shared folder
2. Clicking on the 'Sharing' tab
3. Clicking on 'Advanced Sharing'
4. Clicking on 'Permissions'
5. Make sure that the account has 'Full Control'