I try to use below codes to check current process's user have full permission on the target folder. This codes works fine at WinXP, but failed in Windows 7. Reduce steps: 1. Create a temp folder 2. Deny write permission of "Users" group 3. Call AllAccessGrant with temp folder and FS_FULL_PERMISSION In WinXP, it's return FALSE, but in Windows 7, it's return TRUE. How can I check user's full permission in Windows 7? ---------------------------------------------------------------------- #include "stdafx.h" #include <tchar.h> #include <wtypes.h> #include <atlsecurity.h> #define FS_FULL_PERMISSION 0x001f01ff #define FS_MODIFY_PERMISSION 0x001301bf #define FS_WRITE_PERMISSION 0x001201bf #define FS_READONLY_PERMISSION 0x001200a9 BOOL AllAccessGrant(LPCTSTR lpszFullFilePath,DWORD dwDesiredAccess=FS_FULL_PERMISSION) { // Get discretionary access-control list of target folder CDacl dacl; if(!AtlGetDacl(lpszFullFilePath,SE_FILE_OBJECT,&dacl)) return FALSE; // Get current process access token CAccessToken at; if(!at.GetProcessToken(TOKEN_READ)) return FALSE; // Get current user account's security identifier CSid sid; if(!at.GetUser(&sid)) return FALSE; _tcprintf(_T("Current User:%s\n"),sid.AccountName()); // Build trustee base on sid TRUSTEE trustee; BuildTrusteeWithSid(&trustee, (PSID)sid.GetPSID()); // Get specified user account's effective rights on target folder ACCESS_MASK mask; if(GetEffectiveRightsFromAcl((PACL)dacl.GetPACL(),&trustee,&mask)!=ERROR_SUCCESS) return FALSE; _tcprintf(_T("Access Rights:%d\n"),mask); // Check effective rights are match desired return AreAllAccessesGranted(mask,dwDesiredAccess); }

Hi, This forum is mainly for Windows 7 system questions. Since this issue is related to source code. For such issues, please discuss in our MSDN forum.Arthur Xie - MSFT