Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web server set up with a user 'apache' that has specific rights. I have copied the files over to another server using WinRAR to maintain the NTFS security streams. Now, on the new server I had permissions on the files with just the SID, since there isn't a user account with that SID.

What I want to do is create a named user account that uses that SID so I don't have to redo all the permissions on the files.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

There is no mechanism in Windows to create a user with a specified SID. Indeed, the first portion of the SID is machine or domain-specific anyway-- only the last portion, the relative ID (RID) varies per user on the machine / domain. If, somehow, these two machines were disk-clones of each other you'd have some shot at doing what you want, but even then it would be a hack.

Your best bet is to write a script using the built-in "calcs" command (or the third-party setacl utility) to apply the permission you want and execute that on the web server each time you need to have those permissions applied.

You might be able to get away with a hack by "backing up" the security using the backup functionality of setacl, editing the resulting "backup" file to include the right SID for the destination machine, and then restoring the backup file to the destination machine.

I'd just write a script to set the permissions and store it in your source code control repository along with the rest of the site. It's really part of the configuration of the site and needs to be maintained.

share|improve this answer
    
What would be the command line for setacl to create a backup of the ACLs to a file I could modify and restore on the other server? –  Chris Thompson Jul 21 '09 at 1:41
    
I think I figured it out... –  Chris Thompson Jul 21 '09 at 1:49
    
The setacl program has, arguably, one of the worst command line syntaxes known to man. It beats "sc.exe" easily-- and that's saying something. –  Evan Anderson Jul 21 '09 at 2:12

You can also use NTFSBKP.bat (more info on it here) with SubInAcl to accomplish the hack that Evan mentioned. The only difference is that the backup files it generates store the username rather than the SID so you all you have to do is recreate the same account on the other box and restore.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.