9

I feel like telling a story, so if you want to get to the meat of the question, skip down to the horizontal line.

Original title: Zombies from a dead domain won't give me my files!

I ran into a problem restoring some old archive tapes, where file and folders were owned by users that no longer existed from a domain that no longer existed.

The tapes contained files backed up in Windows 2000, 2003, 2008, 2012 R2 (there may even be some NT4) from local NTFS volumes and CIFS NAS storage arrays, and I'm restoring them in Windows Server 2022.

It was useful in the past to preserve file ownership as that was the only record of authorship for many types of files.

But there appears to have been a period in the early 2000's where people who left the company had their Active Directory accounts deleted rather than disabled. Of course, they owned files and folders on these tapes.

Much later, there was a domain rename, and since the users had been deleted, there was no way to add their SIDs to a SID history, the scope of which was unknown anyway.


Anyway, come today and I'm restoring files from these old tapes, and Windows is restoring the old DACLs and owners from yesteryear. Big mistake: Not only can I not access these files and folders as an admin, I can't force permission inheritance on these files and folders, or even reset the owner using icacls from and elevated command prompt.

icacls <folder> /setowner Administrators /t /c
icacls <folder> /reset /t /c

I also have a script using xcacls.vbs that lets me reset the owner of just folders.

This worked for the files not owned by zombies, but Windows refused access to many, many files.

However, I was able to reset the owners in the File Explorer GUI and push the new owner out to everything underneath. "replace all child object permissions etc.." then replaced the permissions. I could then delete the whole thing.

Now, I can start over without restoring DACLs or owners -- but then, the original non-zombie authors will just have to be forgotten. (The backup software is all or nothing about this).

icacls and xcacls won't clean up the owners and DACLs, even with elevation. But I can do it en masse in File Explorer! Is there a way to do this more selectively using a command prompt?


UPDATE: OK, so @u1686_grawity 's answer set me on the right path. I was able to use takeown to delete the files and start over.

The problem is, takeown /r is a blunt instrument, and just takes ownership of all the files and folders. I could have just restored the files from tape without restoring their original ACLs and owners. The goal was to retain original file ownership (as far as possible) with reset ACLs.

For something a little more selective, I redirected the output of icacls /reset /t /c /q to a text file, then using a text editor to turn each access denied error mesage to a takeown /F command and saved it as a .bat file. Running the batch file and repeating the icacls /reset gave me a new set of files the next level down. After 10 repetitions, this fixed about 40,000 of the 267,678 files. This left 41 files that refused to have their ownership taken. 36 were in 2 directories that had to have their ownership taken manually.

The last 5 files had non-ASCII characters in their names. The batch file would only run if I saved it in DOS encoding, UTF8 wouldn't work.

I was able to manually take ownership of the last 5 files.

It took about 12 hours and that was one tape. I am not sure the juice is worth the squeeze.

2
  • 1
    icacls ... /q /c /t /reset should also set the permissions of sub-folders. See link.
    – harrymc
    Dec 6, 2023 at 20:08
  • @harrymc Except that it didn't.
    – Spencer
    Dec 6, 2023 at 20:13

2 Answers 2

13

The issue with using icacls /setowner is that gaining ownership doesn't implicitly grant you any other rights except "Write ACL" – in particular it doesn't actually grant you the rights to list the directory's contents, or even to read its ACL. You need to take ownership of the top directory, then reset its DACL, then take ownership of first-level subdirectories, reset their DACLs, and so on.

Use takeown /a /r /d y to do this; it'll automatically reset DACLs every time it finds a directory it cannot list.

Alternatively, install the "PSPrivilege" PowerShell module from PSGallery and use it to activate SeBackupPrivilege and SeRestorePrivilege. These broadly allow you to bypass most DACL restrictions, including being able to write DACLs (it's actually what icacls and Explorer use to be able to set arbitrary owners), but by default they're in "held but inactive" state for administrators. Once the two privileges are active, icacls should be more effective.

2

Since there's already a good answer that's probably what the OP wants, here's another option. NTFS support on Linux tends to be really useful (or broken, depending on how you see it, I guess) as it ignores the security from ownership issues. Mount as root, grab files, done. They'll probably still be wrong once you're back in Windows (Windows cares about NTFS security), but at least you've got access to them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .