AD Migrations, and Permissions
One of the things I’ve been working on is migrating our equipment over to the corporate domain off of our domain. For the most part, this has been relatively easy, and given me some changes to fix some things I’ve wanted to get to, but not had time to. One of the stumbling blocks was cutting the file server over to the new server.
I’ll admit I really didn’t plan that server migration too well, but I’ve played it on the side of fixing things as they come up. One of the issues I’ve come across is trying to remember who had access to what originally. As the file server can no longer talk to the old domain controller, it’s not able to resolve the security accounts. This results in the permissions being filled with a bunch of security IDs, rather than names.
I’d originally come up with the idea of using Softerra’s LDAP Browser to search the old AD server for the security IDs. This is where I had an issue. The security IDs in the AD server are stored as binary objects, and LDAP Browser cannot search on it (at least not that I could find).
I did a little Googling around, and stumbled across a nifty utility called ADFind. It allows you to do LDAP queries against the domain controller, and has the added bonus of supporting binary encoding. For example:
adfind –binenc –f “(objectsid={{SID:S-1-…}})”
This encodes the SID, and returns the record for the user or group. This allowed us to go through the file server and fix permissions, and make sure those that should have access, did have access.
Hi,
Thanks for sharing your insightful thoughts and suggestions – very cool and helpful indeed.
In the spirit of sharing helpful information, thought I’d mention that one of my Microsoft colleagues informed us about a cool FREE tool from a Microsoft partner, that offers over 50 super-helpful Active Directory security reports, such as which accounts are locked out, which accounts are set to expire in the next few days, which security groups are nested, where all a user may have permissions etc.
The tool is called Gold Finger, and it is developed by a company called Paramount Defenses. You can download it from http://www.paramountdefenses.com/goldfinger.php
Why bother writing complicated scripts or using unsupported command-line tools when you can use a 100% AUTOMATED, GUI based, FREE solution that is not only SUPPORTED but also ENDORSED by Microsoft?!
If you’re into Active Directory security, then this tool is a must-have. Thought I’d share this helpful tip with you!
Sincerely, JohnM