How do I remove a SID as well as the ACL using PowerShell?

Hi all,

I’m new to the world of Powershell scripting, and I must say that it is a very easy syntax to learn. And once I added the Quest ActiveRoles AD Management snap-in, a whole new world of commands was at my fingertips.

My situation:

I’m writing a script which will automate the creation of Exchange accounts with the use of data from a CSV file using Powershell. This script creates the mailbox, modifies its Active Directory account details, create a few directories and sets its folder permissions (or ACL) for the user of this account. This script works.

I’ve also written a script which automates the cleanup of the Exchange account, where the folder permissions are removed, the directories are deleted and the mailbox is deleted (which in effect deletes the AD account). As far as I can see this works too.

My problem:

When I re-run the creation script, it completes without errors. However, when I go to check folder permissions on the home folder, the permissions are still set to the Security ID (SID) of the previous incarnation of the AD account. Therefore the current incarnation of the user account does not have access to its own home directories because it has a different SID if its own.

This is the code I’m using to remove the ACL from the folder.
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($domainUser,"Modify",$inherit,$propagation,"Allow")
$acl = Get-acl $folder
set-Acl -aclobject $acl $folder

Open in new window

My requirement:

I would like to know if there is a PowerShell command that removes the ACL and the SID at the same time so that if an account is deleted then re-created, I will not run into any issues with accessing the directories.

I have seen code out there that can remove unknown SIDs but it looks more like housekeeping. I want to be able to prevent the problem from happening.

If you need me to post more code or have other questions, let me know. I look forward to your responses.
Who is Participating?
Meir RivkinConnect With a Mentor Full stack Software EngineerCommented:
you can use Ashley Mcglone's powershell scripts to remove sid history when clean the ACL:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.