Managing ABE from the Command Line

Access-based enumeration (ABE) is a feature that first appeared in Windows Server 2003 SP1. In short, it prevents users from seeing files and directories they can't access when they navigate to a share. When ABE is disabled, users can see the existence of all files and folders when they open a share. If they try to open an item they don't have permission to access, they get an “access denied” message. In contrast, if ABE is enabled, the user simply doesn’t see the files and folders they don't have permission to access.

ABE is disabled by default in Windows Server 2003 but enabled by default in Windows Server 2008 and later. You can change that default using the Abecmd.exe command-line tool. However, this tool is missing an important functionality, so I created an alternative solution.

Abecmd.exe’s Downfall

Abecmd.exe is part of the Windows Server 2003 Access-Based Enumeration package. This Windows installer package also includes a white paper on ABE and an ABE GUI for Windows 2003. (Windows 2008 and later includes a built-in GUI that’s part of the Share and Storage Management console.)

With Abecmd.exe, you can easily enable or disable ABE on a computer’s shares on a case-by-case or global basis. However, you can’t view the ABE status for multiple shares on a computer at the same time. I’m perplexed as to why this functionality wasn’t included in the command-line tool. With this functionality, you could easily manage ABE on multiple shares because you could use a script to check each share’s status and change it if needed.

So, I created a solution that lets you easily manage ABE on multiple shares and even multiple computers. This solution consists of three components:

You must be a member of the Administrators group to change the ABE state. If you’re changing the ABE state for shares on the local computer, you must launch PowerShell or Cmd.exe under elevated permissions. To change ABE on a share for a remote computer, you must be a member of the Administrators group on the remote computer; elevation doesn’t matter in this case. If you aren’t a member of the Administrators group on the computer hosting the share, ShareABE.exe returns an error code of 5.

You can download this solution by going to the top of this page and click the Download the Code Here button. Besides including the two scripts and the command-line program, the 129552.zip file includes the program’s Free Pascal source code in case you’re curious.

The solution works on Server 2003 and later, and unlike Abecmd.exe, it even works on Windows 7. I have used the solution with NTFS shares. If you want to use ABE on DFS shares, see “How to implement Windows Server 2003 Access-Based Enumeration in a DFS Environment” or “How to enable Access-Based Enumeration for a Distributed File System (DFS) Share in Windows Server 2008".

To use the solution, copy ShareABE.exe, Get-ABE.ps1, and Set-ABE.ps1 to a directory in your Path (e.g., SystemRootsystem32). The scripts require PowerShell 2.0. If necessary, adjust the PowerShell script policy to enable scripts to run. I recommend using the RemoteSigned policy. (If you’re unfamiliar with the PowerShell policies, see "Running PowerShell Scripts Is as Easy as 1-2-3".)

ShareABE.exe

ShareABE.exe is the tool that makes the PowerShell scripts work. It's also useful as a standalone utility. To run it as a standalone utility, go to a Cmd.exe or PowerShell prompt and run the command

ShareABE ComputerName ShareName \[Action\]

where ComputerName is the name of the computer that hosts the share, ShareName is the share's name, and Action is either the word enable (to enable ABE) or disable (to disable it). If you omit the Action parameter, ShareABE.exe outputs whether ABE is enabled or disabled on the share.

Figure 1 shows ShareABE.exe in action. The first command shows that ABE is disabled for the share, and the second command enables ABE. The third command, which is the same as the first, shows that ABE is indeed enabled for the share.

Figure 1: Sample output from ShareABE.exe when run as a standalone utility

Get-ABE.ps1

Get-ABE.ps1 turns ShareABE.exe into a tool that can report the ABE status for multiple shares on multiple computers. Get-ABE.ps1's command-line syntax is

Get-ABE \[-ComputerName String\]

\[-ShareName String\[\]\]

(Although this command wraps here, you'd enter it all on one line in the PowerShell console. The same holds true for the other commands that wrap.) Both of the script's parameters, -ComputerName and -ShareName, are optional. If you omit -ComputerName, Get-ABE.ps1 assumes you want to check the shares on the local computer only. If you omit -ShareName, Get-ABE.ps1 assumes you want to check all the shares. The share name can contain wildcards. Here are some sample commands:

Get-ABE app1

This command reports on the ABE status of all shares on the server named app1. As this command and the following one show, including the parameters’ names (-ComputerName and -ShareName) is optional.

Get-ABE app1,app2,app3 Scan*

This command reports the ABE status for those shares whose names start with the word Scan on the app1, app2, and app3 servers.

Get-ABE.ps1 also accepts pipeline input for the -ComputerName parameter. For example, the command

Get-Content Servers.txt |
Get-ABE -ShareName Shares,Users

reports the ABE status of the shares named Shares and Users for each of the servers listed in the file Servers.txt (assuming one computer name per line).

Get-ABE.ps1's output consists of custom objects containing the computer name, the share name, the share's path, and a Boolean value (True or False) indicating whether ABE is enabled for the share. Figure 2 shows a sample of Get-ABE.ps1's output.

Figure 2: Sample output from Get-ABE.ps1

Set-ABE.ps1

Set-ABE.ps1 is similar to Get-ABE.ps1, except that it sets the ABE state for shares instead. Its command-line syntax is

Set-ABE \[-ComputerName String\[\]\]

  -ShareName String\[\] \[-Enable\]

  \[-Disable\] \[-WhatIf\] \[-Confirm\]

The -ComputerName parameter is optional. If you omit it, Set-ABE.ps1 assumes the local computer. The -ShareName parameter is required and supports wildcards. So, for example, if you want to enable or disable ABE for all shares, you’d use an asterisk (*) to match all share names. You must include either the -Enable or -Disable parameter (but not both). For testing purposes, Set-ABE.ps1 also supports the -WhatIf and -Confirm parameters. Here are some sample commands:

Set-ABE apps1 * -Enable

This command enables ABE for all shares on apps1. This example omits the parameters’ names
(-ComputerName and -ShareName) because both parameters are present on the command line in the order specified by the syntax.

Set-ABE apps1,apps2,apps3 Users -Disable

This command disables ABE for the Users share on the apps1, apps2, and apps3 servers.

Like Get-ABE.ps1, Set-ABE.ps1 supports pipeline input for computer names. For example, the command

Get-Content Servers.txt |

Set-ABE -ShareName Dep* -Enable

enables ABE for those shares starting with Dep on each server listed in the Servers.txt file (assuming one computer name per line). Figure 3 shows Set-ABE.ps1 in action, including the -Confirm parameter.

Figure 3: Sample output from Set-ABE.ps1

Take Control of ABE

ABE is a helpful tool in the administrator's toolkit, but it lacks a flexible, scriptable administration interface. ShareABE.exe, Get-ABE.ps1, and Set-ABE.ps1 rectify this shortcoming and make it possible to detect, enable, and disable ABE on multiple shares and on multiple computers.