title: Managing remote DACLs on fileshares: Win32_ACE to Win32_Share
body: <p>Goal: Add a local user account share-level Read/Write permissions to an existing file share.</p>
  
  <p>I'm hitting a roadblock in developing this. Apparently Microsoft wants you to add your user's ACE to the DACL and then back into the security descriptor of the share. (1). (No, NET SHARE /ADD is not available for existing shares, I was surprised.) </p>
  
  <p>In theory that should be simple enough, but my main fear is doing it wrong and losing the existing share permissions (lots of network users, specific groups). This solution needs to scale to a few thousand shares. I'm developing the solution to output data about the existing DACL in case I need to back out. I should write code to interpret that log and be prepared to add them back en-masse should anything go wrong.</p>
  
  <p>At the moment I'm using VBscript-- I feel PowerShell might be a bit stronger of an approach but VBscript/WMI is a known quantity.</p>
  
  <p>Research:
  (1) <a href="http://blogs.msdn.com/b/helloworld/archive/2008/07/22/editing-share-permission.aspx" rel="nofollow">http://blogs.msdn.com/b/helloworld/archive/2008/07/22/editing-share-permission.aspx</a></p>