Get-ADXSidHistoryUsage

Namespace ADPlayground.PowerShell

Outputs

ADPlayground.Acl.SidHistoryUsageResult

Scans NTFS and SMB share ACLs to locate SIDHistory-based access.

Examples

Authored help example

Example 1: Scan NTFS paths and share ACLs from a server.


Get-ADXSidHistoryUsage -Path "\\\\FS1\\Data" -ComputerName FS1

Example 2: Scan specific share ACLs only.


Get-ADXSidHistoryUsage -Share "\\\\FS1\\Finance"

Common Parameters

This command supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable.

For more information, see about_CommonParameters.

Syntax

Get-ADXSidHistoryUsage [-AllowList <string[]>] [-ComputerName <string[]>] [-DeadPrefixFile <string>] [-Depth <int>] [-FollowReparse] [-IncludeAll] [-NoNtfs] [-NoResolve] [-NoShares] [-NoSidHistory] [-NoTrusts] [-Parallelism <int>] [-Path <string[]>] [-Share <string[]>] [<CommonParameters>]

Parameters

AllowList string[] optionalposition: namedpipeline: false: Additional SID strings to allow.
ComputerName string[] optionalposition: namedpipeline: falsealiases: Host, Server: Computer names to enumerate shares from.
DeadPrefixFile string optionalposition: namedpipeline: false: Path to a file containing dead/defunct domain SID prefixes (one per line).
Depth int optionalposition: namedpipeline: false: Maximum recursion depth; omit for unlimited.
FollowReparse SwitchParameter optionalposition: namedpipeline: false: Follow reparse points (junctions/symlinks).
IncludeAll SwitchParameter optionalposition: namedpipeline: false: Include all classifications (default: SIDHistory matches only).
NoNtfs SwitchParameter optionalposition: namedpipeline: false: Skip NTFS ACL scanning.
NoResolve SwitchParameter optionalposition: namedpipeline: false: Skip SID-to-name resolution.
NoShares SwitchParameter optionalposition: namedpipeline: false: Skip SMB share ACL scanning.
NoSidHistory SwitchParameter optionalposition: namedpipeline: false: Skip SIDHistory correlation lookups.
NoTrusts SwitchParameter optionalposition: namedpipeline: false: Exclude trusted forests/domains from the internal catalog.
Parallelism int optionalposition: namedpipeline: false: Max degree of parallelism for ACL reads.
Path string[] optionalposition: namedpipeline: falsealiases: Paths, Root: Root paths to scan (local or UNC).
Share string[] optionalposition: namedpipeline: falsealiases: SharePath, Shares: Explicit share paths to scan (UNC roots).

Outputs

ADPlayground.Acl.SidHistoryUsageResult