Saving and moving OU ACLs
I’ve written a batch file that will move ACLs from one OU to another. It works by you outputting the results of a ACL from a OU to a text file, specifying the new OU in a batch file and inputting the text file you just created. I use three utilities to accomplish this: adfind.exe, sed.exe and dsacls.exe.
The command to save the text file is:
1 adfind -b "OU=Users,OU=LAB,DC=LAB,DC=CORP" -f (distinguishedName=OU=Users,OU=LAB,DC=LAB,DC=corp) -sddl++ -resolvesids -onlydacl ntsecuritydescriptor -sddlnotfilter ;inherited| sed.exe "s/;;/; ;/g" | sed.exe "s/;;/; ;/g" | sed.exe "s/;;/; ;/g" | sed.exe "s/;;/; ;/g" > %PATHTOFILE%.txt
From here, you need to delete the header in the text file and the footer.
Once that is done, run this script, changing the two variables at the top:
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576 :RESTORE-OU-ACL.CMD:Restore OU PropertiesSET TARGETOU=OU=Users Accounts,OU=AD Project 3,DC=LAB,DC=CORPSET TARGETFILE="New Text Document (5).txt"@ECHO OFFSETLOCAL ENABLEDELAYEDEXPANSIONfor /F "tokens=1-6 delims=;" %%A IN ('type %TARGETFILE%') DO (SET PROP=SET INHERIT=0IF "%%C" EQU " " SET PROP=GAECHO CALL :PROPERTYACL %%CCALL :PROPERTYACL %%CECHO CALL :INHERITANCE %%BCALL :INHERITANCE %%BSET PROPERTY=IF /I "%%D" NEQ " " SET PROPERTY=%%DECHO PROPERTY=!PROPERTY!SET TARGET=IF /I "%%E" NEQ " " SET TARGET=%%EECHO TARGET=!TARGET!ECHO dsacls "%TARGETOU%" !INHERIT! /G "%%F:!PROP!;!PROPERTY!;!TARGET!"dsacls "%TARGETOU%" !INHERIT! /G "%%F:!PROP!;!PROPERTY!;!TARGET!")GOTO:EOF:INHERITANCEREM We need to figure out what ACLS we're dealing with...FOR /F "tokens=*" %%Z IN ('ECHO %*') DO (IF '!INHERIT!' EQU '/I:S' GOTO:EOFECHO %%Z | FINDSTR /I /C:"[CONT INHERIT]"IF '!ERRORLEVEL!' EQU '0' SET INHERIT=/I:TECHO %%Z | FINDSTR /I /C:"[CONT INHERIT][INHERIT ONLY]"IF '!ERRORLEVEL!' EQU '0' SET INHERIT=/I:SECHO %%Z | FINDSTR /I /C:"INHERIT"IF '!ERRORLEVEL!' EQU '1' SET INHERIT=/I:PECHO INHERIT=!INHERIT!)GOTO:EOF:PROPERTYACLREM We need to figure out what ACLS we're dealing with...FOR /F "tokens=*" %%Z IN ('ECHO %*') DO (ECHO %%Z | FINDSTR /I /C:"WRT PROP"IF '!ERRORLEVEL!' EQU '0' SET PROP=!PROP!WPECHO %%Z | FINDSTR /I /C:"READ PROP"IF '!ERRORLEVEL!' EQU '0' SET PROP=!PROP!RPECHO %%Z | FINDSTR /I /C:"CTL"IF '!ERRORLEVEL!' EQU '0' SET PROP=CAECHO %%Z | FINDSTR /I /C:"[CR CHILD]"IF '!ERRORLEVEL!' EQU '0' SET PROP=!PROP!CCECHO %%Z | FINDSTR /I /C:"[DEL CHILD]"IF '!ERRORLEVEL!' EQU '0' SET PROP=!PROP!DCECHO %%Z | FINDSTR /I /C:"[LIST CHILDREN]"IF '!ERRORLEVEL!' EQU '0' SET PROP=!PROP!LCECHO %%Z | FINDSTR /I /C:"[LIST OBJECT]"IF '!ERRORLEVEL!' EQU '0' SET PROP=!PROP!LOECHO %%Z | FINDSTR /I /C:"[READ]"IF '!ERRORLEVEL!' EQU '0' SET PROP=!PROP!GRECHO %%Z | FINDSTR /I /C:"[FC]"IF '!ERRORLEVEL!' EQU '0' SET PROP=!PROP!GAECHO PROP=!PROP!)GOTO:EOF:/I:P = This Object Only *BLANK*:/I:S = Child Objects Only [CONT INERIT][INHERIT ONLY]:/I:T = This object and all child objects [CONT INERIT]:Blank inheritance = /I:P:When "Properties" are set, it should be /I:S:When there are no properties listed at all ACL should be GA