Question

我尝试使用此命令导出用户权限分配：
secedit /export /areas USER_RIGHTS /cfg d:\privs.txt
然后使用Powershell我尝试将SID转换为名称。这是我的代码：

$output=@()
$temp = "c:\"
$file = "$temp\privs.txt"
[string] $readableNames

$process = [diagnostics.process]::Start("secedit.exe", "/export /cfg $file /areas USER_RIGHTS")
$process.WaitForExit()
$in = get-content $file

foreach ($line in $in) {
    if ($line.StartsWith("Se")) {
    $privilege = $line.substring(0,$line.IndexOf("=") - 1)
    switch ($privilege){
    "SeCreateTokenPrivilege " {$privilege = "Create a token object"}
    "SeAssignPrimaryTokenPrivilege" {$privilege = "Replace a process-level token"}
    "SeLockMemoryPrivilege" {$privilege = "Lock pages in memory"}
    "SeIncreaseQuotaPrivilege" {$privilege = "Adjust memory quotas for a process"}
    "SeUnsolicitedInputPrivilege" {$privilege = "Load and unload device drivers"}
    "SeMachineAccountPrivilege" {$privilege = "Add workstations to domain"}
    "SeTcbPrivilege" {$privilege = "Act as part of the operating system"}
    "SeSecurityPrivilege" {$privilege = "Manage auditing and the security log"}
    "SeTakeOwnershipPrivilege" {$privilege = "Take ownership of files or other objects"}
    "SeLoadDriverPrivilege" {$privilege = "Load and unload device drivers"}
    "SeSystemProfilePrivilege" {$privilege = "Profile system performance"}
    "SeSystemtimePrivilege" {$privilege = "Change the system time"}
    "SeProfileSingleProcessPrivilege" {$privilege = "Profile single process"}
    "SeCreatePagefilePrivilege" {$privilege = "Create a pagefile"}
    "SeCreatePermanentPrivilege" {$privilege = "Create permanent shared objects"}
    "SeBackupPrivilege" {$privilege = "Back up files and directories"}
    "SeRestorePrivilege" {$privilege = "Restore files and directories"}
    "SeShutdownPrivilege" {$privilege = "Shut down the system"}
    "SeDebugPrivilege" {$privilege = "Debug programs"}
    "SeAuditPrivilege" {$privilege = "Generate security audit"}
    "SeSystemEnvironmentPrivilege" {$privilege = "Modify firmware environment values"}
    "SeChangeNotifyPrivilege" {$privilege = "Bypass traverse checking"}
    "SeRemoteShutdownPrivilege" {$privilege = "Force shutdown from a remote system"}
    "SeUndockPrivilege" {$privilege = "Remove computer from docking station"}
    "SeSyncAgentPrivilege" {$privilege = "Synchronize directory service data"}
    "SeEnableDelegationPrivilege" {$privilege = "Enable computer and user accounts to be trusted for delegation"}
    "SeManageVolumePrivilege" {$privilege = "Manage the files on a volume"}
    "SeImpersonatePrivilege" {$privilege = "Impersonate a client after authentication"}
    "SeCreateGlobalPrivilege" {$privilege = "Create global objects"}
    "SeTrustedCredManAccessPrivilege" {$privilege = "Access Credential Manager as a trusted caller"}
    "SeRelabelPrivilege" {$privilege = "Modify an object label"}
    "SeIncreaseWorkingSetPrivilege" {$privilege = "Increase a process working set"}
    "SeTimeZonePrivilege" {$privilege = "Change the time zone"}
    "SeCreateSymbolicLinkPrivilege" {$privilege = "Create symbolic links"}
    "SeDenyInteractiveLogonRight" {$privilege = "Deny local logon"}
    "SeRemoteInteractiveLogonRight" {$privilege = "Allow logon through Terminal Services"}
    "SeServiceLogonRight" {$privilege = "Logon as a service"}
    "SeIncreaseBasePriorityPrivilege" {$privilege = "Increase scheduling priority"}
    "SeBatchLogonRight" {$privilege = "Log on as a batch job"}
    "SeInteractiveLogonRight" {$privilege = "Log on locally"}
    "SeDenyNetworkLogonRight" {$privilege = "Deny Access to this computer from the network"}
    "SeNetworkLogonRight" {$privilege = "Access this Computer from the Network"}
    "SeDenyBatchLogonRight" {$privilege = "Deny log on as a batch job"}
    "SeDenyServiceLogonRight" {$privilege = "Deny log on as a service"}
    "SeDenyRemoteInteractiveLogonRight" {$privilege = "Deny log on through Remote Desktop Services"}
 }
$sids = $line.substring($line.IndexOf("=") + 1,$line.Length - ($line.IndexOf("=") + 1))
$sids =  $sids.Trim() -split ","


$readableNames = ""
    foreach ($str in $sids){
            if($str.StartsWith("*"))
            {
                $str = $str.substring(1)
                $str
                $sid = new-object System.Security.Principal.SecurityIdentifier($str)
                $readableName = $sid.Translate([System.Security.Principal.NTAccount])
                $readableNames = $readableNames + $readableName.Value + ", "
            }
            else
            {
            $readableNames = $readableNames + $str + ", "
            }
     }
    $output += New-Object PSObject -Property @{            
    privilege       = $privilege               
    readableNames   = $readableNames.substring(0,($readableNames.Length - 1))
    #else            = $line."property" 
    } 
 }
}

$output

所以我遇到的问题是我收到错误exception calling translate with 1 argument some or all identity referances could not be translated

$str输出显示，当像S-1-5-21-1042109134-4285797005-3901271436-1004
S-1-5-21-1042109134-4285797005-3901271436-1006 S-1-5-21-1042109134-4285797005-3901271436-1007 $sid.Translate([System.Security.Principal.NTAccount])
导致错误的功能。我无法理解为什么这些SIDS会导致错误。一点点的搜索向我展示了第三个数字（例如，在21号以上的SID中）代表了域名身份。但在输出中我得到的是有不同的第三个数字的SIDS。例如，有：
S-1-5-20
S-1-5-19
我无法理解为什么这些数字不同，因为我不属于任何域名。如果有人解释它会很好。非常感谢。
的 P.S
我已尝试wmic useraccount get name,sid生成用户的每个名称及其相应的SID，并且在输出中没有S-1-5-21-1042109134-4285797005-3901271436-1004
S-1-5-21-1042109134-4285797005-3901271436-1006
S-1-5-21-1042109134-4285797005-3901271436-1007
但他们从哪里来？

Answer 1

S-1-5-21是本地和域用户使用的前缀。它是SID的下一部分，用于确定它所属的域，并且计算机具有自己的域标识符。如果您的SID不会转换为您的用户权限分配，那么它就是已删除的用户或组（孤立的SID）。重现的步骤：

创建本地组
使用gpedit.msc为用户权限分配指定一项权限
删除本地组
运行脚本并观察错误。

S-1-5-20（网络服务）和S-1-5-19（本地服务）是Windows中特殊内置帐户的众所周知的SID。

使用try {} catch {}处理孤立SID的异常。

try {
    $readableName = $sid.Translate([System.Security.Principal.NTAccount])
    $readableName
} catch {
    Write-Host "Could not find SID"
}

Powershell：有些SID不会翻译

1 个答案: