m-dwyer / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
53 stars 103 forks source link

Status code 2310 when executing "KillUserSession.ps1" #16

Open nasstar opened 7 years ago

nasstar commented 7 years ago

I've had some great success with this script so far, so many thanks to all involved. The problem I've discovered is that the "KillUserSession.ps1" script fails to set ACLs on cluster shares. Whenever the __CLASS property for the share is Win32_ClusterShare as opposed to Win32_Share the script returns a status code of 2310, which translates to "This shared resource does not exist".

Below are the object properties of a working Win32_Share:

Status : OK Type : 0 Name : AWB$ GENUS : 2 CLASS : Win32_Share SUPERCLASS : CIM_LogicalElement __DYNASTY : CIM_ManagedSystemElement RELPATH : Win32_Share.Name="AWB$" __PROPERTY_COUNT : 10 DERIVATION : {CIM_LogicalElement, CIM_ManagedSystemElement} SERVER : DMHFSCLS02 NAMESPACE : root\cimv2 PATH : \DMHFSCLS02\root\cimv2:Win32_Share.Name="AWB$" AccessMask : AllowMaximum : True Caption : AWB$ Description : InstallDate : MaximumAllowed : Path : C:\AWB Scope : System.Management.ManagementScope Options : System.Management.ObjectGetOptions ClassPath : \DMHFSCLS02\root\cimv2:Win32_Share Properties : {AccessMask, AllowMaximum, Caption, Description...} SystemProperties : {GENUS, CLASS, SUPERCLASS, DYNASTY...} Qualifiers : {dynamic, Locale, provider, UUID} Site : Container :

Below are the object properties of a non-working Win32_ClusterShare:

GENUS : 2 CLASS : Win32_ClusterShare SUPERCLASS : Win32_Share __DYNASTY : CIM_ManagedSystemElement RELPATH : Win32_ClusterShare.Name="\\BN_NT_NEPTUNE\Users" PROPERTY_COUNT : 11 __DERIVATION : {Win32_Share, CIM_LogicalElement, CIM_ManagedSystemElement} SERVER : DMHFSCLS02 NAMESPACE : root\cimv2 PATH : \DMHFSCLS02\root\cimv2:Win32_ClusterShare.Name="\\BN_NT_NEPTUNE\Users" AccessMask : AllowMaximum : True Caption : Users Description : InstallDate : MaximumAllowed : Name : \BN_NT_NEPTUNE\Users Path : m:\LN-NT-PANDORA Data\Users ServerName : BN_NT_NEPTUNE Status : OK Type : 0 Scope : System.Management.ManagementScope Options : System.Management.ObjectGetOptions ClassPath : \DMHFSCLS02\root\cimv2:Win32_ClusterShare Properties : {AccessMask, AllowMaximum, Caption, Description...} SystemProperties : {GENUS, CLASS, SUPERCLASS, DYNASTY...} Qualifiers : {dynamic, Locale, provider, UUID} Site : Container :

I've worked on this issue all morning with no success as yet, can anyone advise as to why this may be and how I could work around this problem?

Kind regards,

Matt