Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

How do I remove a SID as well as the ACL using PowerShell?

Posted on 2012-04-11
1
Medium Priority
?
1,702 Views
Last Modified: 2012-04-30
Hi all,

I’m new to the world of Powershell scripting, and I must say that it is a very easy syntax to learn. And once I added the Quest ActiveRoles AD Management snap-in, a whole new world of commands was at my fingertips.

My situation:

I’m writing a script which will automate the creation of Exchange accounts with the use of data from a CSV file using Powershell. This script creates the mailbox, modifies its Active Directory account details, create a few directories and sets its folder permissions (or ACL) for the user of this account. This script works.

I’ve also written a script which automates the cleanup of the Exchange account, where the folder permissions are removed, the directories are deleted and the mailbox is deleted (which in effect deletes the AD account). As far as I can see this works too.

My problem:

When I re-run the creation script, it completes without errors. However, when I go to check folder permissions on the home folder, the permissions are still set to the Security ID (SID) of the previous incarnation of the AD account. Therefore the current incarnation of the user account does not have access to its own home directories because it has a different SID if its own.

This is the code I’m using to remove the ACL from the folder.
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($domainUser,"Modify",$inherit,$propagation,"Allow")
$acl = Get-acl $folder
$acl.RemoveAccessRuleAll($accessRule)
set-Acl -aclobject $acl $folder

Open in new window


My requirement:

I would like to know if there is a PowerShell command that removes the ACL and the SID at the same time so that if an account is deleted then re-created, I will not run into any issues with accessing the directories.

I have seen code out there that can remove unknown SIDs but it looks more like housekeeping. I want to be able to prevent the problem from happening.

If you need me to post more code or have other questions, let me know. I look forward to your responses.
0
Comment
Question by:stvmph
1 Comment
 
LVL 42

Accepted Solution

by:
Meir Rivkin earned 2000 total points
ID: 37851283
you can use Ashley Mcglone's powershell scripts to remove sid history when clean the ACL:
http://blogs.technet.com/b/ashleymcglone/archive/2011/11/23/how-to-remove-sid-history-with-powershell.aspx
0

Featured Post

Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

With so many activities to perform, Exchange administrators are always busy in organizations. If everything, including Exchange Servers, Outlook clients, and Office 365 accounts work without any issues, they can sit and relax. But unfortunately, it…
There can be many situations demanding the conversion of Outlook OST files to PST format and as such, there is no shortage of automated tools to perform this conversion. However, what makes Stellar OST to PST converter stand above the rest? Let us e…
This video discusses moving either the default database or any database to a new volume.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

885 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question