Solved

How do I remove a SID as well as the ACL using PowerShell?

Posted on 2012-04-11
1
1,553 Views
Last Modified: 2012-04-30
Hi all,

I’m new to the world of Powershell scripting, and I must say that it is a very easy syntax to learn. And once I added the Quest ActiveRoles AD Management snap-in, a whole new world of commands was at my fingertips.

My situation:

I’m writing a script which will automate the creation of Exchange accounts with the use of data from a CSV file using Powershell. This script creates the mailbox, modifies its Active Directory account details, create a few directories and sets its folder permissions (or ACL) for the user of this account. This script works.

I’ve also written a script which automates the cleanup of the Exchange account, where the folder permissions are removed, the directories are deleted and the mailbox is deleted (which in effect deletes the AD account). As far as I can see this works too.

My problem:

When I re-run the creation script, it completes without errors. However, when I go to check folder permissions on the home folder, the permissions are still set to the Security ID (SID) of the previous incarnation of the AD account. Therefore the current incarnation of the user account does not have access to its own home directories because it has a different SID if its own.

This is the code I’m using to remove the ACL from the folder.
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($domainUser,"Modify",$inherit,$propagation,"Allow")
$acl = Get-acl $folder
$acl.RemoveAccessRuleAll($accessRule)
set-Acl -aclobject $acl $folder

Open in new window


My requirement:

I would like to know if there is a PowerShell command that removes the ACL and the SID at the same time so that if an account is deleted then re-created, I will not run into any issues with accessing the directories.

I have seen code out there that can remove unknown SIDs but it looks more like housekeeping. I want to be able to prevent the problem from happening.

If you need me to post more code or have other questions, let me know. I look forward to your responses.
0
Comment
Question by:stvmph
1 Comment
 
LVL 42

Accepted Solution

by:
sedgwick earned 500 total points
ID: 37851283
you can use Ashley Mcglone's powershell scripts to remove sid history when clean the ACL:
http://blogs.technet.com/b/ashleymcglone/archive/2011/11/23/how-to-remove-sid-history-with-powershell.aspx
0

Join & Write a Comment

Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now