When reading the WMI class Win32_LogicalFileSecuritySetting the SACL property is null

When you try and read the NTFS audit permissions of a file or folder using WMI with the class Win32_LogicalFileSecuritySetting the SACL property is null.

This can be because the user executing the command doesn't have the SeSecurityPrivilege.

PowerShell

The following command will work correctly with PowerShell as long as the user running the command has the SeSecurityPrivilege - with UAC enable PowerShell will need to be run elevated by right clicking PowerShell and selecting Run as Administrator.

$securitySetting = Get-CimInstance -ClassName "Win32_LogicalFileSecuritySetting" -Filter "Path='c:\\temp'";

$securityDescriptor = Invoke-CimMethod -InputObject $securitySetting -MethodName "GetSecurityDescriptor";

$securityDescriptor.Descriptor.SACL;

Wbemtest

When using the WBEMTEST utility you'll need to make sure you are running as an Administrator and also tick Enable all privileges checkbox.

C#.NET

When using C#.NET and the WMI classes in System.Automation you'll need to set EnablePrivileges to true.

                String path = String.Format(@"\\{0}\root\cimv2", hostname, wmiNamespace);

                scope = new ManagementScope(path);

                scope.Options.EnablePrivileges = true;

                scope.Connect();