This weekend I'll be celebrating Christmas in the US. Today Santa brought me a 1500VA 865W UPS for my home lab server. Now I don't have to worry about those winter power hiccups rebooting all of my HyperV guests. Best of all the scripting elves will be able to write presents without interruption.
So in PowerShell style here's a little Christmas gift for you.
This post is the fifth in the "SID Walker, Texas Ranger" series on SID history remediation with PowerShell. Today we're wrapping up with a handy summary of each post in the series. We will also take the function library we've been using and upgrade it to a PowerShell module. Then we'll walk through the entire SID history remediation process using the provided cmdlets in this module.
Those of you who follow my blog know that I have been stuck on this theme of SID history for several months now. Why? Because I see this quite frequently with customers, and I want to offer some practical guidance on dealing with it. Here is a summary of the blog series that brought us to today's module:
I suggest that you go back and read all of the articles linked above. They will give you much more insight into the SID history cleanup process and the nuances of the provided functions. Then skim through the ADMT Guide to get familiar with the big picture.
All of these functions are now wrapped up in the module provided in today's blog post.
If you've never installed a module there really isn't much to it. Here's what you do:
Now you can use Get-Command and Get-Help to unwrap the present and see what's inside:
You can use Get-Help -Full for each of the included functions to find syntax and descriptions.
The outline below will guide you through the process of using the functions to help remediate SID history. Run them in this order.
The functions provided in this module will give you added visibility into the status of your SID history throughout the process and an easy way to target removal in the final phase.
This SID history project has been a lot of fun, and I'm sure there's more we could do with it. I have a few ideas of my own, but I would like to hear your feedback. What challenges have you encountered with SID history remediation? Where do you think PowerShell could help? Leave a comment below and let me know.
If you would like to have me or another Microsoft PFE visit your company and assist with the ideas presented in this blog post, then contact your Microsoft Premier Technical Account Manager (TAM) for booking information.
For more information about becoming a Microsoft Premier customer email PremSale@microsoft.com. Tell them GoateePFE sent you.
I found your scripts quite helpful but have one issue. We are in the process of a forest to forest migration. If I run your Convert script it replaces SID history with the new domain groups. This will cause users in the old group to not have access to the NAS/File Server since they belong to source domain group.
Is there a way to perform and ADD not a replace?
Thanks for the feedback. I'll add that to my list of improvements to implement.
Is there a script (preferably Powershell) that removes SPECIFIC SID histories on a massive scale? I need to clear 6,200 users of certain SID histories as those domains have been removed completely. However, we can't "purge all" as there are still active
old domains the users need access to.
I've asked this question over at the Scripting Guys TECHNET (social.technet.microsoft.com/.../b30ac917-f8c4-4c54-b575-7113b1fab00f),
but haven't been provided any info.
Yes, you can remove them by old domain if you like using the script I provided here:
It gives you the ability to remove SID history selectively in batches by old domain.
Doesnt work in 2008 R2. Extracted to the directory as instructed but the module is never found. Looks OK if it worked.
Sorry to hear of your troubles with the import. Two things I would recommend:
1. Review "help about_modules" to see if you can find any clues about what might not be working for you.
2. If that doesn't work, try importing the module by specifying the module path like this:
Import-Module -Name 'C:\SomePath\modules\SIDHistory\SIDHistory.psm1'
If neither of those work please use the "Email Blog Author" link at the top-right of this page to send me error messages or diagnostic information that will help me troubleshoot your issue.