Is there an Icacls funtion similar to /replace in subinacl?

Question

My company has been utilizing the subinacl tool to fix SIDs that change unexpectedly. We are now switching over to Windows 7 and the subinacl tool is no longer utilized. I am trying to find the code equivalents of the subinacl funtions for Icacls and so far the only one I have been unable to find has been /replace. The /substitute function seems similar but I can't tell if it is exactly what I need.

Does anyone know if the /substitute function in Icacls has the same functionality as /replace? If not, do you know what I can use to change the name of every instance of an SID to another?

Answer 1

The end result of substitute is the same as replace, but it works a bit differently. You can't just do:

icacls . /substitute oldsid newsid

Substitute is not a command on its own.

Instead, you need to save the acls for the file, then restore them using the subsitute param. As an example, this will save the acls for all the files in the current directory, then restore while replacing the sid:

icacls * /save acls.bak
icacls . /substitute oldsid newsid /restore acls.bak

Here is an article that walks you through the process.