0

I need to reference the "Domain-Admins" group in a batch file. The line in question looks like this:

icacls "test\folder" /grant mydomain.com\Domain-Admins:F

... and works as expected.

But how do I reference the "Domain-Admin" group in general? My german windows server tells me something about "Domänen-Admins", the Italians call ist "Amministratore-Admins" (or whatever) and I dont want to know what the russian Domain Admins call themselves. I did not want to offend any international names, there must just be a solution for a generic adressing of roles. I need a solution for everybody - like Microsoft had in mind (hopefully) when they used SIDs.

I know the SID of the domain admin group looks like S-1-5-21mydomainsid-512, but icacls does not understand S-1-5-21*-512.

How do I use icacls wisely when I need to reference international group names?

3
  • ask yourself first how you ask wisely to an international group of people. And, no, I am not italian.
    – PA.
    Feb 28, 2013 at 14:43
  • You are right, I am very sorry. I did not want to offend anyone (especially italians in this case). Again,s orry for this (and thanks PA for pointing this out to me). I do know that different countrys have their own names (for groups here) and I am (very) angry over my own stupidity to 'catch' the SID-concept in icacls. Dou you have an idea about how to handle international names in batch files? (or how to use SID-MAsks correctly in icacls)
    – bjoster
    Feb 28, 2013 at 14:51
  • 1
    I have a english domain and a dutch client. On this client I can use "mydomain\domain admins" (between quotes and with a space) without any problems.
    – ZEDA-NL
    Mar 1, 2013 at 8:15

1 Answer 1

1

You should be able to grant by SID with icacls. Microsoft documentation even has an example granting permissions by SID.

Is each international locale a different domain/sid? You would need to add the sid or icacls separately for each domain into the batch file.

3
  • I think the OP may be trying to use a wildcard "*" in the SID?
    – jscott
    Feb 28, 2013 at 15:36
  • Yes, wildcards are the thing I need (I think). SIDs with wildcards like S-1-1-0: do work, but not if the wildcard is -in- the SID´, like S-1--0:. The Domain-SID is the middle part of the complete SID (following the documentation), so wildcard do not work here (in icacls).
    – bjoster
    Feb 28, 2013 at 16:27
  • Every domain has its very own SID and this script should work in a lot (if not all :-) of them.
    – bjoster
    Feb 28, 2013 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .