Invoke-ADXSidHistoryRecovery

Namespace ADPlayground.PowerShell

Outputs

ADPlayground.Migrations.SidHistory.SidHistoryRecoveryExecutionResult

Executes governed SIDHistory recovery from captured cleanup evidence.

Examples

Authored help example

Example 1: Recover a removed SIDHistory value only after cleanup evidence shows replacement access failed.


$cleanup = Get-ADXSidHistoryCleanupPlan -Domain new.contoso.com -SamAccountName alice -SidHistoryToRemove S-1-5-21-1-2-3-1101 -ResourceAclScanCompleted -ReplacementAccessValidated -RecoveryEvidenceCaptured -TrustCleanupPlanned -ProxyCleanupReviewed -ChangeReason CAB-1234
            $cleanup.Items | Format-Table Principal, SidHistoryValue, CanRemove, RecoveryEvidenceRequired, Message -AutoSize
            Invoke-ADXSidHistoryRecovery -SourceDomain old.contoso.com -SourceSamAccountName alice -DestinationDomain new.contoso.com -DestinationSamAccountName alice -RemovedSidHistory S-1-5-21-1-2-3-1101 -ReplacementAccessFailed -RecoveryReason 'Replacement access failed after cleanup' -SourceAuditReady -SourceTcpipClientSupportReady -ResourceAclScanCompleted -Intent read_write -AllowWrite -Apply -WriteExecutionId exec-2 -WriteActorId admin -WriteChangeReason INC-9 -WriteRollbackPlanId rollback-2

Common Parameters

This command supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable.

For more information, see about_CommonParameters.

Syntax

Invoke-ADXSidHistoryRecovery -DestinationDomain <string> -DestinationSamAccountName <string> -RemovedSidHistory <string> -SourceDomain <string> -SourceSamAccountName <string> [-AllowPrivilegedSidHistory] [-AllowWrite] [-Apply] [-BusinessJustification <string>] [-CleanupExecutionId <string>] [-DestinationCredential <PSCredential>] [-DestinationDomainController <string>] [-DryRun <bool>] [-Intent <string>] [-RecoveryReason <string>] [-RemovedAtUtc <DateTimeOffset>] [-ReplacementAccessFailed] [-ResourceAclDependencyCount <int>] [-ResourceAclScanCompleted] [-SourceAuditReady] [-SourceCredential <PSCredential>] [-SourceDomainController <string>] [-SourceTcpipClientSupportReady] [-WriteActorId <string>] [-WriteAuditCorrelationId <string>] [-WriteChangeReason <string>] [-WriteExecutionId <string>] [-WriteRollbackPlanId <string>] [-WriteRollbackProviderId <string>] [<CommonParameters>]

Parameters

DestinationDomain string requiredposition: namedpipeline: false: Destination DNS domain name.
DestinationSamAccountName string requiredposition: namedpipeline: false: Destination domain-relative SAM account name.
RemovedSidHistory string requiredposition: namedpipeline: false: Removed SIDHistory value to recover.
SourceDomain string requiredposition: namedpipeline: false: Source DNS domain name.
SourceSamAccountName string requiredposition: namedpipeline: false: Source domain-relative SAM account name.
AllowPrivilegedSidHistory SwitchParameter optionalposition: namedpipeline: false: Allows migration of privileged source SIDs when explicitly approved.
AllowWrite SwitchParameter optionalposition: namedpipeline: falsealiases: allow_write: Explicit write confirmation flag for mutating operations.
Apply SwitchParameter optionalposition: namedpipeline: false: Applies changes. Without this switch, the cmdlet runs in dry-run mode.
BusinessJustification string optionalposition: namedpipeline: false: Business justification or change ticket.
CleanupExecutionId string optionalposition: namedpipeline: false: Cleanup execution identifier that removed the value.
DestinationCredential PSCredential optionalposition: namedpipeline: false: Optional destination-domain credential.
DestinationDomainController string optionalposition: namedpipeline: false: Destination domain controller.
DryRun bool optionalposition: namedpipeline: falsealiases: dry_run: Dry-run mode flag. Defaults to true; set to false and use -Apply to execute writes.
Intent string optionalposition: namedpipeline: false: Execution intent (read_only or read_write). Default: read_only.
RecoveryReason string optionalposition: namedpipeline: false: Reason for recovery.
RemovedAtUtc DateTimeOffset optionalposition: namedpipeline: false: Time the SIDHistory value was removed.
ReplacementAccessFailed SwitchParameter optionalposition: namedpipeline: false: Confirms that replacement access failed and recovery is justified.
ResourceAclDependencyCount int optionalposition: namedpipeline: false: Number of resource ACL dependencies still relying on the source SID.
ResourceAclScanCompleted SwitchParameter optionalposition: namedpipeline: false: Confirms that resource ACL dependency discovery was completed.
SourceAuditReady SwitchParameter optionalposition: namedpipeline: false: Confirms that source audit prerequisites are ready.
SourceCredential PSCredential optionalposition: namedpipeline: false: Optional source-domain administrator credential.
SourceDomainController string optionalposition: namedpipeline: false: Source PDC emulator or source domain controller.
SourceTcpipClientSupportReady SwitchParameter optionalposition: namedpipeline: false: Confirms that source TcpipClientSupport is ready.
WriteActorId string optionalposition: namedpipeline: falsealiases: write_actor_id: Write actor identifier.
WriteAuditCorrelationId string optionalposition: namedpipeline: falsealiases: write_audit_correlation_id: Optional write audit correlation identifier.
WriteChangeReason string optionalposition: namedpipeline: falsealiases: write_change_reason: Write change reason, ticket, or approval reference.
WriteExecutionId string optionalposition: namedpipeline: falsealiases: write_execution_id: Write execution identifier for governance/audit correlation.
WriteRollbackPlanId string optionalposition: namedpipeline: falsealiases: write_rollback_plan_id: Write rollback plan identifier.
WriteRollbackProviderId string optionalposition: namedpipeline: falsealiases: write_rollback_provider_id: Optional write rollback provider identifier.

Outputs

ADPlayground.Migrations.SidHistory.SidHistoryRecoveryExecutionResult