5

Running a really simple ICACLS command after I copied a directory over to a new server with permissions intact. I need to change a SID from an old server user group to a new server user group.

Copied folder with ROBOCOPY source dest /SEC...

Got the SID of the old server user group and new server user group using PSGetSid.

icacls folder /save acl /t
icacls folder /substitute S-blahold S-blahnew /restore acl

I get an error that says: s-blahold: No mapping between account names and security IDs was done.

I've tried replacing the SID with the servername\group. I'm running as Administrator account that has admin access to old and new servers.

Source server is Windows 2003, destination is Server 2008.

Improve this question
2
  • Are the servers in the same domain?
    – Joe Niland
    Apr 22, 2013 at 0:20
  • @JoeN Yes, they are in the same domain.
    – Brad
    Apr 23, 2013 at 20:56

2 Answers 2

Reset to default
2

If they are in the same domain you might be able to use the friendly format, e.g. DOMAIN\USERNAME. I have found this does work when in the same domain.

The other thing is: you are prefixing the SID's with an asterisk, right?

Lastly, you could try subinacl - this allows doing an SID replace without actually looking up the object for existence in AD.

Improve this answer
2
  • Joe, I don't believe I was prefixing the SIDs with an asterisk. I did end up using subinacl to change the permissions. I have another server migration coming up and I will try icacls with asterisks.
    – Brad
    May 8, 2013 at 13:40
  • @Brad - good to hear. subinacl is a more robust tool in general.
    – Joe Niland
    May 14, 2013 at 6:33
-1

You could use subinacl to perform this task

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .