« Inheritance and Propagation in Active Directory permissions | Main | Extended Rights in Active Directory »
Security Identifiers (SIDs) and NT Account name
By Adam Bell | March 26, 2007
I have a couple of functions that are quite useful when dealing with Active Directory permissions.
Translate SID to NT Account:
:get-NTaccount.ps1
#----------------------------------------------------------------------------------------------------------
function get-NTaccount
#----------------------------------------------------------------------------------------------------------
{
Param (
$SID
)
$id = New-Object System.Security.Principal.SecurityIdentifier($sid)
$account = $id.Translate( [System.Security.Principal.NTAccount] )
return $account
}
#----------------------------------------------------------------------------------------------------------
get-NTaccount "S-1-5-21-812403740-544655063-2921696178-1958"
In this function we take a SID in string format, and cast it as a SecurityIdentifier and then use the .Net method to translate this into the NT Account name.
Translate NT Account to SID:
:get-SID.ps1
#----------------------------------------------------------------------------------------------------------
function get-sid
#----------------------------------------------------------------------------------------------------------
{
Param (
$DSIdentity
)
$ID = new-object System.Security.Principal.NTAccount($DSIdentity)
return $ID.Translate( [System.Security.Principal.SecurityIdentifier] ).toString()
}
#----------------------------------------------------------------------------------------------------------
get-sid "bella"
This is basically the same premise as above, only we are working the other way around. If you provide a name without a domain prefix or UPN, the method presumes the current domain.
So with our Test OU, you can output the SDDL format of the Security Descriptor to a text file to examine the permissions.
:noclick
$root = [adsi]""
$test = [adsi]("LDAP://ou=test ou,"+$root.distinguishedName)
$test.psbase.get_objectsecurity().GetSecurityDescriptorSddlForm("All") > DS-SDDL.txt
When you start playing around with Security Discriptors, and examining various permissions structures, it quickly becomes very useful to be able to translate SID’s back and forth to confirm things are working as expected.
- None Found
Topics: PowerShell | 1 Comment »
November 20th, 2009 at 23:45
[...] http://www.leadfollowmove.com/archives/powershell/security-identifiers-sids-and-nt-account-name [...]