不明なアカウントから所有権とアクセス制御を奪い取るPowerShellスクリプト

migrate_acl.ps1

[String]$sid = "<Fill in the old SID here>"
[String]$newuser = "<Fill in the new username here(domain\user)>"

$path = Get-ChildItem "<Fill in the directory to perform operation(note that the directory specified here will not be modified)>" -Recurse
foreach($file in $path) {
  $acl = Get-Acl -LiteralPath $file.FullName
  if($acl.Owner -eq "O:$sid") {
    foreach($acc in $acl.access) {
      if($acc.IdentityReference.Value -match $sid) {
        $newacc = New-Object System.Security.AccessControl.FileSystemAccessRule($newuser, @($acc.FileSystemRights), @($acc.InheritanceFlags), @($acc.PropagationFlags), @($acc.AccessControlType))
        $acl.RemoveAccessRule($acc) | Out-Null
        $acl.AddAccessRule($newacc) | Out-Null
        Set-Acl -LiteralPath $file.FullName -AclObject $acl -ErrorAction Stop
        Write-Host "Migrating AccessControl information for file $file"
      }
    }
    $ntaccount = New-Object System.Security.Principal.NTAccount($newuser)
    $acl.SetOwner($ntaccount)
    Set-Acl -LiteralPath $file.FullName -AclObject $acl -ErrorAction Stop
    Write-Host "chown orphaned $sid => $newuser for file $file"
  }
}