From 12e97ffbd3470d05e91cd1c0c3545c41e66ad671 Mon Sep 17 00:00:00 2001 From: Claude A Date: Sun, 9 Aug 2026 00:44:07 +0200 Subject: [PATCH] Set-DbaPrivilege - Write secedit's working database to temp, not cwd secedit /configure /db resolves a bare filename against the process's current directory, not $env:TEMP. The relative "secedit.sdb" argument left secedit.sdb and its secedit.jfm journal file behind wherever the caller happened to be running the command. Point /db at an absolute $temp path instead, and clean up the database and journal file alongside the exported cfg. (do Set-DbaPrivilege) Co-Authored-By: Claude Sonnet 5 --- .../Commands/SetDbaPrivilegeCommand.cs | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/project/dbatools.computer/Commands/SetDbaPrivilegeCommand.cs b/project/dbatools.computer/Commands/SetDbaPrivilegeCommand.cs index 80ef4b9e..6d9c317f 100644 --- a/project/dbatools.computer/Commands/SetDbaPrivilegeCommand.cs +++ b/project/dbatools.computer/Commands/SetDbaPrivilegeCommand.cs @@ -51,7 +51,10 @@ public sealed class SetDbaPrivilegeCommand : DbaBaseCmdlet $strSID.Value }"; - // The three Invoke-Command2 -Raw scriptblocks, verbatim from the PS source (comments included). + // The three Invoke-Command2 -Raw scriptblocks, verbatim from the PS source (comments + // included), except MainScript's /db path and CleanupScript's extra Remove-Item - see the + // secedit.sdb/.jfm fix note on CleanupScript below. The retired PS source (dbatools/private/ + // retired/Set-DbaPrivilege.ps1) still carries the original bug; it is dead code, not shipping. private const string ExportScript = @" $temp = ([System.IO.Path]::GetTempPath()).TrimEnd(""""); secedit /export /cfg $temp\secpolByDbatools.cfg > $NULL; "; @@ -198,10 +201,14 @@ public sealed class SetDbaPrivilegeCommand : DbaBaseCmdlet } } } - $null = secedit /configure /cfg $tempfile /db secedit.sdb /areas USER_RIGHTS /overwrite /quiet + $null = secedit /configure /cfg $tempfile /db $temp\secedit.sdb /areas USER_RIGHTS /overwrite /quiet "; - private const string CleanupScript = @" $temp = ([System.IO.Path]::GetTempPath()).TrimEnd(""""); Remove-Item $temp\secpolByDbatools.cfg -Force > $NULL "; + // secedit /configure /db resolves a bare filename against the process's current directory, + // not $temp - a relative "secedit.sdb" left secedit.sdb/.jfm wherever the caller's shell + // happened to be running. Point /db at $temp and clean up the database and its journal file + // alongside the exported cfg. + private const string CleanupScript = @" $temp = ([System.IO.Path]::GetTempPath()).TrimEnd(""""); Remove-Item $temp\secpolByDbatools.cfg -Force > $NULL; Remove-Item $temp\secedit.sdb, $temp\secedit.jfm -Force -ErrorAction SilentlyContinue > $NULL "; // PS begin block: $ComputerName = $ComputerName.ComputerName | Select-Object -Unique. The // variable keeps its [DbaInstanceParameter[]] type constraint, so the unique ComputerName