Windows Server 2008: Notes on Moving a Hard Drive to a New Machine; Orphaned SIDs; TAKEOWN.EXE; ICACLS.EXE; Get-Acl; Set-Acl

It is very possible that orphaned SIDs (security IDs for unknown users) will appear when a drive (virtual or physical) is moved to a new machine. What is worse is when the orphaned SID is the owner of the file/folder.

Windows machines updated after the release of Vista have the TAKEOWN command for Administrators. This is the first command to use before any other permissions operations can be done (otherwise you may get strange permission-denied messages, even with root privileges).

To take ownership of a directory root (c:\\root) and sub folders and files for the Administrators group, this is the form:

takeown /f c:&bsol;&bsol;root /a

The next thing to do is reset all privileges to defaults with the ICACLS command. This is done when you know you have not set any custom permissions on any files in the drive (or when you already have a script to rebuild custom permissions). This reset is important because it should remove all orphaned SIDs and ensure that default inheritance is in place. This is the form:

icacls c:&bsol;&bsol;root /reset /t

Evan Anderson at serverfault.com wrote a script to sketch out his view of this procedure:

@echo off FOR /D %%i in (*) do ( TAKEOWN /f "%%i" /r /d y ICACLS "%%i" /reset /T ICACLS "%%i" /grant:r "DOMAIN\\%%i":(OI)(CI)F rem Unremark this line to set the owner to the user, if you like that rem ICACLS "%%i" /setowner "DOMAIN\\%%i" /T )

[http://serverfault.com/questions/45251/ script-to-reset-home-directory-permissons-on-a-windows-share]

Icacls on Technet [http://technet.microsoft.com/en-us/library/cc753525%28WS.10%29.aspx].

Some idea of what PowerShell can do about this issue is in “Hey, Scripting Guy! How Can I Use Windows PowerShell to Determine the Owner of a File?” [http://www.microsoft.com/technet/scriptcenter/resources/qanda/apr08/hey0415.mspx].

mod date: 2009-09-28T17:02:03.000Z