Solved

How do I remove a SID as well as the ACL using PowerShell?

Posted on 2012-04-11
1
1,612 Views
Last Modified: 2012-04-30
Hi all,

I’m new to the world of Powershell scripting, and I must say that it is a very easy syntax to learn. And once I added the Quest ActiveRoles AD Management snap-in, a whole new world of commands was at my fingertips.

My situation:

I’m writing a script which will automate the creation of Exchange accounts with the use of data from a CSV file using Powershell. This script creates the mailbox, modifies its Active Directory account details, create a few directories and sets its folder permissions (or ACL) for the user of this account. This script works.

I’ve also written a script which automates the cleanup of the Exchange account, where the folder permissions are removed, the directories are deleted and the mailbox is deleted (which in effect deletes the AD account). As far as I can see this works too.

My problem:

When I re-run the creation script, it completes without errors. However, when I go to check folder permissions on the home folder, the permissions are still set to the Security ID (SID) of the previous incarnation of the AD account. Therefore the current incarnation of the user account does not have access to its own home directories because it has a different SID if its own.

This is the code I’m using to remove the ACL from the folder.
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($domainUser,"Modify",$inherit,$propagation,"Allow")
$acl = Get-acl $folder
$acl.RemoveAccessRuleAll($accessRule)
set-Acl -aclobject $acl $folder

Open in new window


My requirement:

I would like to know if there is a PowerShell command that removes the ACL and the SID at the same time so that if an account is deleted then re-created, I will not run into any issues with accessing the directories.

I have seen code out there that can remove unknown SIDs but it looks more like housekeeping. I want to be able to prevent the problem from happening.

If you need me to post more code or have other questions, let me know. I look forward to your responses.
0
Comment
Question by:stvmph
1 Comment
 
LVL 42

Accepted Solution

by:
sedgwick earned 500 total points
ID: 37851283
you can use Ashley Mcglone's powershell scripts to remove sid history when clean the ACL:
http://blogs.technet.com/b/ashleymcglone/archive/2011/11/23/how-to-remove-sid-history-with-powershell.aspx
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article explains the steps required to use the default Photos screensaver to display branding/corporate images
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question