2

I am writing a PowerShell script that needs to edit the xml config file for the Claims to Windows Token Service (C2WTS) as "any user" but have been unable to save the file once I have made changes to the XML object. Using the following code:

$xml.load("C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config")
changes here
$xml.save("C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config")

Running this code, I get the error:

Exception calling "Save" with "1" argument(s): "Access to the path 'C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config' is denied."

I have tried setting the ACL so that the user running the script can then edit the XML file with the following code:

$acl = Get-Acl "C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config"
$Ar = New-Object system.Security.AccessControl.FileSystemAccessRule($user,"FullControl","Allow")
$acl.SetAccessRule($Ar)
Set-Acl "C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config" $acl

but get an error returned as:

"Set-Acl : Attempted to perform an unauthorized operation."

Can anyone help me get to a point where I can save the changes I have made to the XML file?

1 Answer 1

0

Not sure what OS you are using, but the Vista kernel hates anything writing to Program Files except installers. Some older programs are not compatible because they attempt to download updates and so on to that folder and fail. I have not investigated the reasons since I believe it is a good thing overall. But I'm sure that permissions issues are involved. Have you checked the permissions on the target folder and its parents?

Additionally, I don't know how relevant it is, but if the file is being accessed by anything, it will not be available for editing. The error messages produced usually mimic those of permissions issues. Do you know if there is another handle to that file?

1
  • The OS is windows server 2008 R2 and the file has security settings for administrators and users. Administrators have Full control, but users only have Read & Execute set. I thought that Set-ACL would be the cmdlet that would enable the file to be amended?
    – Vermin
    Jul 18, 2011 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .