Change Sid in NTUSER.DAT..?? - KiXtart.org - official site

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » Change Sid in NTUSER.DAT..??

Page 1 of 1

1

Topic Options

#39411 - 2003-04-22 09:15 PM Change Sid in NTUSER.DAT..??
mima mima Hey THIS is FUN Registered: 2002-01-25 Posts: 217 Loc: Jönköping, Sweden	Hi I read a lot on this site about Sid problems when migrating from one domain to another. I am trying with kix changed the permissions (Sid) in a users Ntuser.dat (registry). But I am stuck. I dont know which functions I can use. Does anyone know how I can do this ? I know the old Sid and the new Sid. /Mima
Top

#39412 - 2003-04-22 09:28 PM Re: Change Sid in NTUSER.DAT..??
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	mima, Talked with our person doing the migration and he mentioned that they are using Bindview. http://www.bindview.com HTH, Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

#39413 - 2003-04-22 09:30 PM Re: Change Sid in NTUSER.DAT..??
Howard Bullock Howard Bullock KiX Supporter Registered: 2000-09-15 Posts: 5809 Loc: Harrisburg, PA USA	You can accomplish this with the proper version of SubInACL too. _________________________ Home page: http://www.kixhelp.com/hb/
Top

#39414 - 2003-04-22 09:31 PM Re: Change Sid in NTUSER.DAT..??
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11634 Loc: Space	http://www.netiq.com has tools for migration as well. Including mapping of SIDS Not saying things can't be done with KiX or other method, but you need ALL the details or you'll end up with a mess in the end.
Top

#39415 - 2003-04-22 09:34 PM Re: Change Sid in NTUSER.DAT..??
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11634 Loc: Space	Here is a link with more information on the topic. http://www.sans.org/rr/win/NTFS.php
Top

#39416 - 2003-04-22 10:02 PM Re: Change Sid in NTUSER.DAT..??
mima mima Hey THIS is FUN Registered: 2002-01-25 Posts: 217 Loc: Jönköping, Sweden	My problem is not NTFS rights on the server... The problem I am having is that I MUST use the OLD user profile (inluding NTUSER.DAT) on the users computer, when the computer is moved to a new domain. I am using NETDOM.EXE. When the computer is in the NEW domain and the user is logging on, the permissions in NTUSER.DAT is wrong. I can use the local administrator and load that NTUSER.DAT in Regedt32.exe and change permissions. But I want to do that with a script. Does anyone know how that can be done ? /Mima
Top

#39417 - 2003-04-22 10:05 PM Re: Change Sid in NTUSER.DAT..??
Howard Bullock Howard Bullock KiX Supporter Registered: 2000-09-15 Posts: 5809 Loc: Harrisburg, PA USA	As I said, SubInACL can process the internal ACLs. You will have to load the user hives and all will be good. I have processed thousands of computers from OLD SIDs to New SIDS for domain migrations where we have issued new accounts to acquisitions (NT4 to NT4 and NT4 to W2K). [ 22. April 2003, 22:11: Message edited by: Howard Bullock ] _________________________ Home page: http://www.kixhelp.com/hb/
Top

#39418 - 2003-04-22 10:38 PM Re: Change Sid in NTUSER.DAT..??
mima mima Hey THIS is FUN Registered: 2002-01-25 Posts: 217 Loc: Jönköping, Sweden	How do I load the user hives with kix, or do I use SubInACL for that purpose ? /Mima
Top

#39419 - 2003-04-22 10:44 PM Re: Change Sid in NTUSER.DAT..??
mima mima Hey THIS is FUN Registered: 2002-01-25 Posts: 217 Loc: Jönköping, Sweden	Howard I read your migration article on your website. VERY IMPRESSING. You are using Perl, and there is a part of code like this #----------------------------------------------------------------------------- # Create new key based on new SID by copying OldSID Key. # Set the binary sid to the correct sid. #----------------------------------------------------------------------------- $Key = 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'; $ProfileKey = $HKLM->Open($Key); $OldSidKey = $ProfileKey->Open($OldSid); $OldSidKey->CopyKey($ProfileKey, $NewSid); $NewSidKey = $ProfileKey->Open($NewSid); $NewSidKey->SetValues('Sid',®_BINARY,$NewBinarySid); #----------------------------------------------------------------------------- I dont understand Perl, but does this code load the profile and change the Sid ? If it is so, can this be done with kix ? /Mima
Top

#39420 - 2003-04-23 01:40 PM Re: Change Sid in NTUSER.DAT..??
mima mima Hey THIS is FUN Registered: 2002-01-25 Posts: 217 Loc: Jönköping, Sweden	Ok everybody. Now I tried the utility SubInACL and with that I can change the Sid in Ntuser.dat. Thats good. But now I want to do this with a script. How can I load the Ntuser.dat into my registry with Kix? The function LoadHive() does only load a file that is created in Regedt32.exe. This is manual stuff. /Mima
Top

#39421 - 2003-04-23 01:51 PM Re: Change Sid in NTUSER.DAT..??
mima mima Hey THIS is FUN Registered: 2002-01-25 Posts: 217 Loc: Jönköping, Sweden	Stop.... It worked to load the Ntuser.dat with LoadHive() I must have been sleeping last time I tried. /Mima
Top

#39422 - 2003-04-23 01:52 PM Re: Change Sid in NTUSER.DAT..??
Jochen Jochen KiX Supporter Registered: 2000-03-17 Posts: 6380 Loc: Stuttgart, Germany	Ummmm ... Oh well, If you go to the command prompt and simply type subinacl there is a bit more information ... especially the section with /object_type is of interest for you I think. OR ... did I miss something? You want to change SIDs that are registry values inside ntuser.dat ?` Hmmm ... then we have a bit of a catch 22 situation there Hint: ntuser.dat is nothing else than HKEY_CURRENT_USER _________________________
Top

#39423 - 2003-04-23 01:53 PM Re: Change Sid in NTUSER.DAT..??
Jochen Jochen KiX Supporter Registered: 2000-03-17 Posts: 6380 Loc: Stuttgart, Germany	Oh, it did ? Great ... so the rest is routine _________________________
Top

#39424 - 2003-04-23 05:50 PM Re: Change Sid in NTUSER.DAT..??
Howard Bullock Howard Bullock KiX Supporter Registered: 2000-09-15 Posts: 5809 Loc: Harrisburg, PA USA	Ok now that everyone has thought about this a bit, what are the remaining questions? Mima, the Perl code you that deals with the ProfileList key configures the OS to think that the NEW userID has already logged onto the computer and has a profile. In fact, the NEW userID has never been used on this computer. If this step was not done then the NEW userID would be given a DEFAULT profile (desktop) and the user would scream, "what happened to be my stuff!" The preconfigured profile is pointed to the OLD userID's profile. Now both IDs have the same profile. In my program I executed as an Admin and scanned the ProfileList key and loaded ALL NTuser.DAT hives into the registry at one time. Then I executed SubInACL to update ALL the ACLS of ALL users based on an OFFLINE SAM file that contains the SIDS of both the old domain and new domain accounts. [ 23. April 2003, 17:51: Message edited by: Howard Bullock ] _________________________ Home page: http://www.kixhelp.com/hb/
Top

#39425 - 2003-04-24 11:02 AM Re: Change Sid in NTUSER.DAT..??
mima mima Hey THIS is FUN Registered: 2002-01-25 Posts: 217 Loc: Jönköping, Sweden	Ok Howard. I agree about everything you said. My plan is the same with creating a new Sid key and point the path to the old profile, and then run SubInAcl and so on. MY PROBLEM NOW is the value SID under the users SID key. I cant understand how that is created. If I take the sid and write a reg_binary it doesnt be the same as if I log in with the user and let the system create the key. You write that key in yoy Perl script with a value $NewBinarySid. Where do you get this value ? If this value is not correct it says Unknown account in the profile list under This Computer. /Mima
Top

#39426 - 2003-04-24 01:08 PM Re: Change Sid in NTUSER.DAT..??
Howard Bullock Howard Bullock KiX Supporter Registered: 2000-09-15 Posts: 5809 Loc: Harrisburg, PA USA	I use Perl to pack the string representation into a binary sid that the system uses. The easiest way for you to get the BinarySID would be to use ADSI and the objectSID attribute. I think that this is the same thing. If this does not work let me know and I will provide you an alternative method. quote: Object SID [This is preliminary documentation and subject to change.] The user's SID can be retrieved using the objectSID attribute. The objectSID is returned as a VARIANT array of the string. sid = usr.Get("objectSID") [ 24. April 2003, 13:09: Message edited by: Howard Bullock ] _________________________ Home page: http://www.kixhelp.com/hb/
Top

#39427 - 2003-04-24 01:53 PM Re: Change Sid in NTUSER.DAT..??
mima mima Hey THIS is FUN Registered: 2002-01-25 Posts: 217 Loc: Jönköping, Sweden	Hello Howard I found a function written by a known person ...! Its like this and it is just what I was looking for. ;FUNCTION StrSidToHexSid($StringSid); ;AUTHOR Howard A. Bullock (habullock@comcast.net) ; ;ACTION Converts a Sid in string (S-1-5-21-...) format to Hex format. ; ;SYNTAX StrSidToHexSid($StringSid) ; ;PARAMETERS $StringSid (Required) - String value ; ;REMARKS Do not prefix the computer name with "\\"'s. ; ;RETURNS String ; ;DEPENDENCIES KiXtart 4.02 ; ;EXAMPLES StrSidToHexSid("S-1-5-21-24129212-1035812195-1543859470-1401") ; returns "010500000000000515000000BC2E7001633DBD3D0E6D055C79050000" ; Now I will make all the code ready for launch. I will published the code here when I done. /Mima
Top

#39428 - 2003-04-24 02:11 PM Re: Change Sid in NTUSER.DAT..??
Howard Bullock Howard Bullock KiX Supporter Registered: 2000-09-15 Posts: 5809 Loc: Harrisburg, PA USA	I am not sure that the Hex SID (still text) is what you want for the BinarySid. Regedit might display (interpret) the binary data to show the hex representation but I don't think you can write the hex sid string data into the REG_BINARY value. Have you tried this? With what result? I just sent you via email the latest version of SubInACL I have that supports UNICODE. I thought you might need that support if you have Localized Nordic OS's. [ 24. April 2003, 14:12: Message edited by: Howard Bullock ] _________________________ Home page: http://www.kixhelp.com/hb/
Top

Page 1 of 1

1

Previous Topic

Previous Topic View All Topics

View All Topics

Index Next Topic

Next Topic

Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart

Hop to:

Shout Box

Who's Online

0 registered and 1046 anonymous users online.

Newest Members

Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.085 seconds in which 0.063 seconds were spent on a total of 12 queries. Zlib compression enabled.

click tracking