August 2010 - The Practical Administrator

This morning while standing up a new vScan A/V server I wanted to look up our McAfee service account. I knew the account would be a domain account, and I knew it would be a member of the backup operators group on the filer. With that in mind I ran the following.

<span style="color: #ffffff;"><span style="font-size: x-small;"><span style="font-family: Lucida Console; font-size: x-small;"><span style="color: #ffff00;"><strong>[0:4]&gt;</strong></span> Get-NaDomainUser -Group "Backup Operators"

SID
---
S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-112477
S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-111419
S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-146727
</span></span></span>

[0:4]> Get-NaDomainUser -Group "Backup Operators"

SID

---

S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-112477

S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-111419

S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-146727

Well that’s rather useless… Unfortunately, the OnTAP API doesn’t provide a means to convert a SID to a NTAccount. This is normally accomplished via the “cifs lookup” command on the Ontap CLI, but that doesn’t help us much from the toolkit. Fortunately .Net provides a native means to perform this conversion. This isn’t new to anyone who has been following PowerShell for a while (//o// first posted these function way back in the Monad days), but that doesn’t make them any less useful!

<span style="color: #00008b;">Function</span> <span style="color: #8a2be2;">ConvertTo-NTAccount</span>
<span style="color: #000000;">{</span>
    <span style="color: #00008b;">Param</span><span style="color: #000000;">(</span>
        <span style="color: #a9a9a9;">[</span><span style="color: #add8e6;">Parameter</span><span style="color: #000000;">(</span><span style="color: #000000;">Mandatory</span><span style="color: #a9a9a9;">=</span><span style="color: #ff4500;">$true</span><span style="color: #a9a9a9;">,</span>
            <span style="color: #000000;">HelpMessage</span><span style="color: #a9a9a9;">=</span><span style="color: #8b0000;">"Enter the Sid to translate"</span><span style="color: #a9a9a9;">,</span>
            <span style="color: #000000;">ValueFromPipeLine</span><span style="color: #a9a9a9;">=</span><span style="color: #ff4500;">$true</span><span style="color: #a9a9a9;">,</span>
            <span style="color: #000000;">ValueFromPipelineByPropertyName</span><span style="color: #a9a9a9;">=</span><span style="color: #ff4500;">$true</span>
        <span style="color: #000000;">)</span><span style="color: #a9a9a9;">]</span>
        <span style="color: #008080;">[string]</span>
        <span style="color: #ff4500;">$SID</span>
    <span style="color: #000000;">)</span>
    <span style="color: #00008b;">Process</span> <span style="color: #000000;">{</span>
        <span style="color: #ff4500;">$SIDObject</span> <span style="color: #a9a9a9;">=</span> <span style="color: #0000ff;">New-Object</span> <span style="color: #8a2be2;">system.security.principal.securityidentifier</span><span style="color: #000000;">(</span><span style="color: #ff4500;">$SID</span><span style="color: #000000;">)</span>
        <span style="color: #0000ff;">write-output</span> <span style="color: #ff4500;">$SIDObject</span><span style="color: #a9a9a9;">.</span><span style="color: #000000;">translate</span><span style="color: #000000;">(</span><span style="color: #008080;">[system.security.principal.ntaccount]</span><span style="color: #000000;">)</span>
    <span style="color: #000000;">}</span>
<span style="color: #000000;">}</span>
<span style="color: #00008b;">Function</span> <span style="color: #8a2be2;">ConvertTo-SID</span>
<span style="color: #000000;">{</span>
    <span style="color: #00008b;">Param</span><span style="color: #000000;">(</span>
        <span style="color: #a9a9a9;">[</span><span style="color: #add8e6;">Parameter</span><span style="color: #000000;">(</span><span style="color: #000000;">Mandatory</span><span style="color: #a9a9a9;">=</span><span style="color: #ff4500;">$true</span><span style="color: #a9a9a9;">,</span>
            <span style="color: #000000;">HelpMessage</span><span style="color: #a9a9a9;">=</span><span style="color: #8b0000;">"Enter the NTAccount to translate in the form of domainaccount"</span><span style="color: #a9a9a9;">,</span>
            <span style="color: #000000;">ValueFromPipeLine</span><span style="color: #a9a9a9;">=</span><span style="color: #ff4500;">$true</span><span style="color: #a9a9a9;">,</span>
            <span style="color: #000000;">ValueFromPipelineByPropertyName</span><span style="color: #a9a9a9;">=</span><span style="color: #ff4500;">$true</span>
        <span style="color: #000000;">)</span><span style="color: #a9a9a9;">]</span>
        <span style="color: #008080;">[string]</span>
        <span style="color: #ff4500;">$NTAccount</span>
    <span style="color: #000000;">)</span>
    <span style="color: #00008b;">Process</span> <span style="color: #000000;">{</span>
        <span style="color: #ff4500;">$NTAccountObject</span> <span style="color: #a9a9a9;">=</span> <span style="color: #0000ff;">New-Object</span> <span style="color: #8a2be2;">system.security.principal.NtAccount</span><span style="color: #000000;">(</span><span style="color: #ff4500;">$NTaccount</span><span style="color: #000000;">)</span>
        <span style="color: #0000ff;">write-output</span> <span style="color: #ff4500;">$NTAccountObject</span><span style="color: #a9a9a9;">.</span><span style="color: #000000;">translate</span><span style="color: #000000;">(</span><span style="color: #008080;">[system.security.principal.securityidentifier]</span><span style="color: #000000;">)</span>
    <span style="color: #000000;">}</span>
<span style="color: #000000;">}

</span>Armed with my trusty functions Let's try this again!

Function ConvertTo-NTAccount

{

Param(

[Parameter(Mandatory=$true,

HelpMessage="Enter the Sid to translate",

ValueFromPipeLine=$true,

ValueFromPipelineByPropertyName=$true

)]

[string]

$SID

)

Process {

$SIDObject = New-Object system.security.principal.securityidentifier($SID)

write-output $SIDObject.translate([system.security.principal.ntaccount])

}

Function ConvertTo-SID

{

Param(

HelpMessage="Enter the NTAccount to translate in the form of domainaccount",

ValueFromPipeLine=$true,

ValueFromPipelineByPropertyName=$true

)]

[string]

$NTAccount

)

Process {

$NTAccountObject = New-Object system.security.principal.NtAccount($NTaccount)

write-output $NTAccountObject.translate([system.security.principal.securityidentifier])

}

}

Armed with my trusty functions Let's try this again!

<span style="color: #ffffff;"><span style="font-size: x-small;"><span style="font-family: Lucida Console; font-size: x-small;"><span style="color: #ffff00;"><strong>[0:15]&gt;</strong></span> Get-NaDomainUser -Group "Backup Operators" | ConvertTo-NTAccount

Value
-----
GetAdminsvcAV
GetAdminsvcBackup
GetAdminsvcMNV
</span></span></span>

[0:15]> Get-NaDomainUser -Group "Backup Operators" | ConvertTo-NTAccount

Value

-----

GetAdminsvcAV

GetAdminsvcBackup

GetAdminsvcMNV

Now that’s more like it! This is what I Love about powershell. In the past I would have had to push back on my sales rep, who would have inturn pushed back on the development team. fast forward a year, and maybe I would have a workaround. Or I would have had to try and glue a couple third party exe together (yuck). With PowerShell if I don’t like something I simply extend it in script. No development, nothing complicated, just a couple line of PowerShell. Best of all I can then provide this to the vendor as a concreate example of what I want in the next release (hint hint NetApp cifs lookup needs to be in the SDK!)

It really is just great stuff.
~Glenn

VMworld Labs: Hands-On

PowerShell: DataOnTAP and SID Convertions