Troubles using SIDHistory - KiXtart.org - official site

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » Troubles using SIDHistory

Page 1 of 1

1

Topic Options

#39028 - 2003-04-10 11:12 AM Troubles using SIDHistory
Slak Slak Lurker Registered: 2003-04-10 Posts: 2 Loc: Zwolle, The Netherlands	Hi, We are migrating users from NT4 to Win2k ( AD native ). All computer accounts and resources still retain in the NT4 environment. In the NT4 environment we were using Kixstart to map drives. Now is my question: After migrating the users from NT4 to Win2k with the SIDHistory attribute ( for accessing the resources in NT4 ) Kix 4.12 cannot map drives anymore based on NT4 group membership. As far as I know the new Kix looks at the SID of the currently logged-on user, so I guess it discards group membership based on the "old" SID stored in the SIDHistory attribute? Is it possible for Kix to make mappings based on the "old" SID??? We are not planning to migrate the global groups to Win2k yet... Thx in advance, Eric
Top

#39029 - 2003-04-10 01:57 PM Re: Troubles using SIDHistory
Howard Bullock Howard Bullock KiX Supporter Registered: 2000-09-15 Posts: 5809 Loc: Harrisburg, PA USA	I will think about this some today. It should be possible to write a UDF that could accomplish this task. _________________________ Home page: http://www.kixhelp.com/hb/
Top

#39030 - 2003-04-11 06:09 AM Re: Troubles using SIDHistory
Howard Bullock Howard Bullock KiX Supporter Registered: 2000-09-15 Posts: 5809 Loc: Harrisburg, PA USA	i can't seem to find a way using ADSI to check group membership using user a SID or list of SIDS (sidhistory). ADSI wants ADsPath. I probably could do this in Perl but that is not what you need. Anyone else out there with any ideas? _________________________ Home page: http://www.kixhelp.com/hb/
Top

#39031 - 2003-04-11 09:02 AM Re: Troubles using SIDHistory
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11634 Loc: CA	Hmmm. Well, if your in NATIVE mode, you can't use anything from the NT 4 Domain as NT 4 Domain Controllers are not allowed in a Native mode 2000 AD. If you have a trust relationship setup you can treat it as another resource just like when in NT 4.0 Not sure what you mean by Migration though. If your users are in AD, then they don't have same SID history as they did on NT. You might be able to "MAP" the old NT SIDs to the NEW AD SIDS, but then I'm not sure if you could do much with that data or not. I'm not saying that something can't be done, but sounds like a complex issue that would possibly require some dedicated effort to figure out a resolution.
Top

#39032 - 2003-04-11 03:46 PM Re: Troubles using SIDHistory
Sealeopard Sealeopard KiX Master Registered: 2001-04-25 Posts: 11165 Loc: Boston, MA, USA	I would also go the way of a trust relationship between the new nateve AD domain and the old NT4 domain. _________________________ There are two types of vessels, submarines and targets.
Top

#39033 - 2003-04-16 10:19 AM Re: Troubles using SIDHistory
Slak Slak Lurker Registered: 2003-04-10 Posts: 2 Loc: Zwolle, The Netherlands	Let me explain a little bit more. There are two domains: Domain1 ( NT4 ) and Domain2 ( Win2k ). Between the two domains there is a trust, so users in Domain2 can access resources in Domain1. This trust also is necessary to migrate the accounts. The migration tool used is FastLane Migrator ( this can be compared with ADMT, but more advanced features are available ). The migration we do is import the SamAccountName ( used to logon in W'98/NT ) and the SIDHistory of the NT4 account into the existing Win2k account. In this way resources are available through the Win2k account on the NT4 domain using the SID of the NT4 account, so re-ACLing is not necessary. When the user is migrated, the Kix script doesn't recognize the user belonging to the group it seems... And therefore doesn't map the drives. To me it looks Kix is looking at the Win2k SID of the account, and not looking at the SIDHistory. I guess there must be a way Kix can refer to the SIDHistory???
Top

#39034 - 2003-04-16 01:40 PM Re: Troubles using SIDHistory
Howard Bullock Howard Bullock KiX Supporter Registered: 2000-09-15 Posts: 5809 Loc: Harrisburg, PA USA	We avoid SID history like the plague and re-ACL. KiXtart does not seem to understand SID history in the INGROUP command as you have stated by your example. See my suggestion: http://www.kixtart.org/board/ultimatebb.php?ubb=get_topic;f=4;t=000320 My thought process above was to get the SID references from the SID history and then get the SIDS from the group in question and check for membership. I could not find and ADSI method(s) to collect the SIDs from a group in any efficient way. _________________________ Home page: http://www.kixhelp.com/hb/
Top

Page 1 of 1

1

Previous Topic

Previous Topic View All Topics

View All Topics

Index Next Topic

Next Topic

Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart

Hop to:

Shout Box

Who's Online

1 registered (StuTheCoder) and 798 anonymous users online.

Newest Members

Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.055 seconds in which 0.024 seconds were spent on a total of 12 queries. Zlib compression enabled.

click tracking