Get-ADXSidHistoryCleanupPlan

Namespace ADPlayground.PowerShell

Outputs

ADPlayground.Migrations.SidHistory.SidHistoryCleanupPlan

Builds a due-diligence plan before removing SIDHistory values.

Examples

Authored help example

Example 1: Preview cleanup only after the migration plan and resource review show replacement access is ready.


$migration = New-ADXMigrationPlan -SourceDomain old.contoso.com -DestinationDomain new.contoso.com -DestinationOrganizationalUnit 'OU=Migrated,DC=new,DC=contoso,DC=com' -SourceAuditReady -SourceTcpipClientSupportReady -ResourceAclScanCompleted -BusinessJustification CAB-1234 {
                New-ADXMigrationUser -SourceSamAccountName alice -CredentialStrategy Manual -MigrateMembership
                New-ADXMigrationResource -Path '\\FS1\Finance' -ReAclMode AddDestinationBeforeRemoveSource
            }
            $migration | Test-ADXMigrationPlan -PassThru | Select-Object -ExpandProperty Phases | Format-Table Kind, Item, Description -AutoSize
            Get-ADXSidHistoryCleanupPlan -Domain new.contoso.com -SamAccountName alice -SidHistoryToRemove S-1-5-21-1-2-3-1101 -ResourcePath '\\FS1\Finance' -ReplacementAccessValidated -RecoveryEvidenceCaptured -TrustCleanupPlanned -ProxyCleanupReviewed -ChangeReason CAB-1234 | Select-Object -ExpandProperty ResourceAclDependencies
            Get-ADXSidHistoryCleanupPlan -Domain new.contoso.com -SamAccountName alice -SidHistoryToRemove S-1-5-21-1-2-3-1101 -ResourceAclScanCompleted -ReplacementAccessValidated -RecoveryEvidenceCaptured -TrustCleanupPlanned -ProxyCleanupReviewed -ChangeReason CAB-1234

Common Parameters

This command supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable.

For more information, see about_CommonParameters.

Syntax

Get-ADXSidHistoryCleanupPlan -Domain <string> -SamAccountName <string> [-ChangeReason <string>] [-ProxyCleanupReviewed] [-RecoveryEvidenceCaptured] [-RecurseResourceAclScan] [-ReplacementAccessValidated] [-ResourceAclScanCompleted] [-ResourcePath <string[]>] [-SidHistoryToRemove <string[]>] [-TrustCleanupPlanned] [<CommonParameters>]

Parameters

Domain string requiredposition: namedpipeline: false: DNS domain name.
SamAccountName string requiredposition: namedpipeline: false: Domain-relative SAM account name.
ChangeReason string optionalposition: namedpipeline: false: Operator or ticket justifying cleanup.
ProxyCleanupReviewed SwitchParameter optionalposition: namedpipeline: false: Confirms that FSP/shadow-principal proxy cleanup was reviewed.
RecoveryEvidenceCaptured SwitchParameter optionalposition: namedpipeline: false: Confirms that recovery evidence was captured before removal.
RecurseResourceAclScan SwitchParameter optionalposition: namedpipeline: false: Scans child files and directories under each directory resource path.
ReplacementAccessValidated SwitchParameter optionalposition: namedpipeline: false: Confirms that replacement access through current destination SIDs was validated.
ResourceAclScanCompleted SwitchParameter optionalposition: namedpipeline: false: Confirms that resource ACL dependency discovery was completed.
ResourcePath string[] optionalposition: namedpipeline: false: Filesystem or UNC paths to scan for remaining SIDHistory ACL dependencies.
SidHistoryToRemove string[] optionalposition: namedpipeline: false: Specific SIDHistory values to evaluate for removal. Empty means all current values.
TrustCleanupPlanned SwitchParameter optionalposition: namedpipeline: false: Confirms that trust cleanup was planned.

Outputs

ADPlayground.Migrations.SidHistory.SidHistoryCleanupPlan