Running a really simple ICACLS command after I copied a directory over to a new server with permissions intact. I need to change a SID from an old server user group to a new server user group.

Copied folder with ROBOCOPY source dest /SEC...

Got the SID of the old server user group and new server user group using PSGetSid.

icacls folder /save acl /t
icacls folder /substitute S-blahold S-blahnew /restore acl

I get an error that says: s-blahold: No mapping between account names and security IDs was done.

I've tried replacing the SID with the servername\group. I'm running as Administrator account that has admin access to old and new servers.

Source server is Windows 2003, destination is Server 2008.

  • Are the servers in the same domain?
    – Joe Niland
    Apr 22 '13 at 0:20
  • @JoeN Yes, they are in the same domain.
    – Brad
    Apr 23 '13 at 20:56

If they are in the same domain you might be able to use the friendly format, e.g. DOMAIN\USERNAME. I have found this does work when in the same domain.

The other thing is: you are prefixing the SID's with an asterisk, right?

Lastly, you could try subinacl - this allows doing an SID replace without actually looking up the object for existence in AD.

  • Joe, I don't believe I was prefixing the SIDs with an asterisk. I did end up using subinacl to change the permissions. I have another server migration coming up and I will try icacls with asterisks.
    – Brad
    May 8 '13 at 13:40
  • @Brad - good to hear. subinacl is a more robust tool in general.
    – Joe Niland
    May 14 '13 at 6:33

You could use subinacl to perform this task

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.