3

I have a web server set up with a user 'apache' that has specific rights. I have copied the files over to another server using WinRAR to maintain the NTFS security streams. Now, on the new server I had permissions on the files with just the SID, since there isn't a user account with that SID.

What I want to do is create a named user account that uses that SID so I don't have to redo all the permissions on the files.

2 Answers 2

5

There is no mechanism in Windows to create a user with a specified SID. Indeed, the first portion of the SID is machine or domain-specific anyway-- only the last portion, the relative ID (RID) varies per user on the machine / domain. If, somehow, these two machines were disk-clones of each other you'd have some shot at doing what you want, but even then it would be a hack.

Your best bet is to write a script using the built-in "calcs" command (or the third-party setacl utility) to apply the permission you want and execute that on the web server each time you need to have those permissions applied.

You might be able to get away with a hack by "backing up" the security using the backup functionality of setacl, editing the resulting "backup" file to include the right SID for the destination machine, and then restoring the backup file to the destination machine.

I'd just write a script to set the permissions and store it in your source code control repository along with the rest of the site. It's really part of the configuration of the site and needs to be maintained.

3
  • What would be the command line for setacl to create a backup of the ACLs to a file I could modify and restore on the other server? Jul 21, 2009 at 1:41
  • I think I figured it out... Jul 21, 2009 at 1:49
  • 1
    The setacl program has, arguably, one of the worst command line syntaxes known to man. It beats "sc.exe" easily-- and that's saying something. Jul 21, 2009 at 2:12
0

You can also use NTFSBKP.bat(dead link, no archive available) (more info on it here) with SubInAcl to accomplish the hack that Evan mentioned. The only difference is that the backup files it generates store the username rather than the SID so you all you have to do is recreate the same account on the other box and restore.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .