Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there an automated way to traverse a filesystem and remove any ACL entries that reference invalid SIDs in any version of Windows with NTFS?

share|improve this question

2 Answers 2

Maybe it's because I am running this on a 2003 server, but this does not produce useful results for me.

ICACLS name /verify [/T] [/C] [/L] [/Q] finds all files whose ACL is not in canonical form or whose lengths are inconsistent with ACE counts.

I'm not sure what that is supposed to do, but it doesn't provide anything useful for me. I have a folder with an unknown SID.

ICACLS foldername

returns the ACL entries, including "No mapping between account names and security IDs was done". It does not tell me which SID it failed to get a mapping for.

ICACLS foldername /verify

All this tells me is: "Successfully processed 1 files; Failed processing 0 files". Sounds great, but what was the result of the processing?

I get the exact same results running this on any individual files in the folder as well. In order to remove the SIDs, you need to know what they are. And this is not a very helpful method for getting a list of the SIDs that need to be cleaned up.

share|improve this answer

icacls can do that:

ICACLS name [/grant[:r] Sid:perm[...]] [/deny Sid:perm [...]] [/remove[:g|:d]] Sid[...]] [/T] [/C] [/L] [/Q] [/setintegritylevel Level:policy[...]]

    /remove[:[g|d]] Sid removes all occurrences of Sid in the ACL. With
    :g, it removes all occurrences of granted rights to that Sid. With
    :d, it removes all occurrences of denied rights to that Sid.

You can also check for bad entries:

ICACLS name /verify [/T] [/C] [/L] [/Q] finds all files whose ACL is not in canonical form or whose lengths are inconsistent with ACE counts.

share|improve this answer
    
FILEACL do this as well. –  Rob Nicholson Jul 25 '10 at 11:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.