从SID返回用户数据

Question

尝试使用SID转换器查看哪些用户对特定打印机具有权限（最终我将修改为用于多台打印机），接收错误您无法在空值表达式上调用方法。以下是我所拥有的。

GuzzleHttp\Handler\CurlFactory::finishError(Object, Object, Object) (Line: 103)
GuzzleHttp\Handler\CurlFactory::finish(Object, Object, Object) (Line: 43)
GuzzleHttp\Handler\CurlHandler->__invoke(Object, Array) (Line: 28)
GuzzleHttp\Handler\Proxy::GuzzleHttp\Handler\{closure}(Object, Array) (Line: 51)
GuzzleHttp\Handler\Proxy::GuzzleHttp\Handler\{closure}(Object, Array) (Line: 37)
GuzzleHttp\PrepareBodyMiddleware->__invoke(Object, Array) (Line: 30)
GuzzleHttp\Middleware::GuzzleHttp\{closure}(Object, Array) (Line: 70)
GuzzleHttp\RedirectMiddleware->__invoke(Object, Array) (Line: 57)
GuzzleHttp\Middleware::GuzzleHttp\{closure}(Object, Array) (Line: 67)
GuzzleHttp\HandlerStack->__invoke(Object, Array) (Line: 277)
GuzzleHttp\Client->transfer(Object, Array) (Line: 125)
GuzzleHttp\Client->requestAsync('get', 'https://maps.googleapis.com/maps/api/geocode/json', Array) (Line: 131)
GuzzleHttp\Client->request('get', 'https://maps.googleapis.com/maps/api/geocode/json', Array) (Line: 89)
GuzzleHttp\Client->__call('get', Array) (Line: 273)
GuzzleHttp\Client->get('https://maps.googleapis.com/maps/api/geocode/json', Array) (Line: 273)

更新：此功能将SID转换为用户名，我需要为打印机上的所有用户执行此操作，以便查询多台打印机。

$SID = [System.Security.Principal.SecurityIdentifier]::(
(Get-Printer 'Test-Printer-MFP' -Full).PermissionSDDL
)
$User = ($SID.Translate([System.Security.Principal.NTAccount]))

Return $User.Value

Answer 1

PermissionSDDL属性为您提供SDDL format中的安全描述符，而不是SID。该格式的安全描述符中的ACE strings包含字符串SID（ S-x-y -... ）或SID constants。您可以拆分字符串，提取SID，并像在代码中尝试一样转换它们。但是，这只会处理字符串SID，而不是SID常量。

将字符串SID和SID常量解析为相应名称的更好方法是将安全描述符从SDDL格式转换为对象格式。一些快速的Google搜索显示this article使用SetSecurityDescriptorSddlForm()方法将SDDL字符串转换为＆＃34;常规＆＃34; ACL对象：

Function Convert-SDDLToACL {
    [Cmdletbinding()]
    Param (
        #One or more strings of SDDL syntax.
        [string[]]$SDDLString
    )

    foreach ($SDDL in $SDDLString) {
        $ACLObject = New-Object -Type Security.AccessControl.DirectorySecurity
        $ACLObject.SetSecurityDescriptorSddlForm($SDDL)
        $ACLObject.Access
    }
}

该函数返回生成的安全描述符对象的ACE。您可以从该列表中提取用户/组/主体名称，如下所示：

$sddl = (Get-Printer 'Test-Printer-MFP' -Full).PermissionSDDL
Convert-SDDLToACL $sddl |
    Select-Object -Expand IdentityReference |
    Select-Object -Expand Value