ファイルの所有者をSYSTEMに設定する方法は？

Question

コードワイズが、これは非常に簡単です：「セキュリティ識別子は、このオブジェクトの所有者であることを許可されていない」これは言う例外をスロー

var fs = IO.File.GetAccessControl(path); 
fs.SetOwner(new NTAccount("NT AUTHORITY\\SYSTEM")); 
IO.File.SetAccessControl(path, fs); 

これは、私がこのユーザーを所有者として割り当てる権利を持っていないことを意味します（source 1、source 2）。しかし、エクスプローラーを使ってこのファイルの所有者をSYSTEMに簡単に設定できます。エクスプローラは何とかすることができるので、私は必要な権利を持っている必要があります。どうすればエクスプローラが何をし、ファイルの所有者をSYSTEMに設定できますか？必要なことはすべてのプロセスのトークンにこの特権を有効にすることですAdjustTokenPrivilegesとSE_RESTORE_NAMEに向けて、私を指摘Christian.Kの助けを借りて

Answer 1

、：ここで

// Allow this process to circumvent ACL restrictions 
WinAPI.ModifyPrivilege(PrivilegeName.SeRestorePrivilege, true); 

// Sometimes this is required and other times it works without it. Not sure when. 
WinAPI.ModifyPrivilege(PrivilegeName.SeTakeOwnershipPrivilege, true); 

// Set owner to SYSTEM 
var fs = IO.File.GetAccessControl(path); 
fs.SetOwner(new NTAccount("NT AUTHORITY\\SYSTEM")); 
IO.File.SetAccessControl(path, fs); 

は、このようなModifyPrivilegeヘルパーメソッドのコードです：

static class WinAPI 
{ 
    /// <summary> 
    ///  Enables or disables the specified privilege on the primary access token of the current process.</summary> 
    /// <param name="privilege"> 
    ///  Privilege to enable or disable.</param> 
    /// <param name="enable"> 
    ///  True to enable the privilege, false to disable it.</param> 
    /// <returns> 
    ///  True if the privilege was enabled prior to the change, false if it was disabled.</returns> 
    public static bool ModifyPrivilege(PrivilegeName privilege, bool enable) 
    { 
     LUID luid; 
     if (!LookupPrivilegeValue(null, privilege.ToString(), out luid)) 
      throw new Win32Exception(); 

     using (var identity = WindowsIdentity.GetCurrent(TokenAccessLevels.AdjustPrivileges | TokenAccessLevels.Query)) 
     { 
      var newPriv = new TOKEN_PRIVILEGES(); 
      newPriv.Privileges = new LUID_AND_ATTRIBUTES[1]; 
      newPriv.PrivilegeCount = 1; 
      newPriv.Privileges[0].Luid = luid; 
      newPriv.Privileges[0].Attributes = enable ? SE_PRIVILEGE_ENABLED : 0; 

      var prevPriv = new TOKEN_PRIVILEGES(); 
      prevPriv.Privileges = new LUID_AND_ATTRIBUTES[1]; 
      prevPriv.PrivilegeCount = 1; 
      uint returnedBytes; 

      if (!AdjustTokenPrivileges(identity.Token, false, ref newPriv, (uint) Marshal.SizeOf(prevPriv), ref prevPriv, out returnedBytes)) 
       throw new Win32Exception(); 

      return prevPriv.PrivilegeCount == 0 ? enable /* didn't make a change */ : ((prevPriv.Privileges[0].Attributes & SE_PRIVILEGE_ENABLED) != 0); 
     } 
    } 

    const uint SE_PRIVILEGE_ENABLED = 2; 

    [DllImport("advapi32.dll", SetLastError = true)] 
    [return: MarshalAs(UnmanagedType.Bool)] 
    static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, [MarshalAs(UnmanagedType.Bool)] bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, 
     UInt32 BufferLengthInBytes, ref TOKEN_PRIVILEGES PreviousState, out UInt32 ReturnLengthInBytes); 

    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)] 
    [return: MarshalAs(UnmanagedType.Bool)] 
    static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out LUID lpLuid); 

    struct TOKEN_PRIVILEGES 
    { 
     public UInt32 PrivilegeCount; 
     [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1 /*ANYSIZE_ARRAY*/)] 
     public LUID_AND_ATTRIBUTES[] Privileges; 
    } 

    [StructLayout(LayoutKind.Sequential)] 
    struct LUID_AND_ATTRIBUTES 
    { 
     public LUID Luid; 
     public UInt32 Attributes; 
    } 

    [StructLayout(LayoutKind.Sequential)] 
    struct LUID 
    { 
     public uint LowPart; 
     public int HighPart; 
    } 
} 

enum PrivilegeName 
{ 
    SeAssignPrimaryTokenPrivilege, 
    SeAuditPrivilege, 
    SeBackupPrivilege, 
    SeChangeNotifyPrivilege, 
    SeCreateGlobalPrivilege, 
    SeCreatePagefilePrivilege, 
    SeCreatePermanentPrivilege, 
    SeCreateSymbolicLinkPrivilege, 
    SeCreateTokenPrivilege, 
    SeDebugPrivilege, 
    SeEnableDelegationPrivilege, 
    SeImpersonatePrivilege, 
    SeIncreaseBasePriorityPrivilege, 
    SeIncreaseQuotaPrivilege, 
    SeIncreaseWorkingSetPrivilege, 
    SeLoadDriverPrivilege, 
    SeLockMemoryPrivilege, 
    SeMachineAccountPrivilege, 
    SeManageVolumePrivilege, 
    SeProfileSingleProcessPrivilege, 
    SeRelabelPrivilege, 
    SeRemoteShutdownPrivilege, 
    SeRestorePrivilege, 
    SeSecurityPrivilege, 
    SeShutdownPrivilege, 
    SeSyncAgentPrivilege, 
    SeSystemEnvironmentPrivilege, 
    SeSystemProfilePrivilege, 
    SeSystemtimePrivilege, 
    SeTakeOwnershipPrivilege, 
    SeTcbPrivilege, 
    SeTimeZonePrivilege, 
    SeTrustedCredManAccessPrivilege, 
    SeUndockPrivilege, 
    SeUnsolicitedInputPrivilege, 
}