Each time we reinstalled Windows, it will create a new SID for user even the username is as same as before.
// example (not real SID format, just show the problem)user SID--------------------liuyan S-old-501 // old SID before reinstallliuyan S-new-501 // new SID after reinstallThe annoying problem after reinstall is NTFS file owership and permissions on hard drive disk are still associated with old user's SID.
I want to keep the ownership and permission setting of NTFS files, then want to let the new user take the old user's SID, so that I can access files as before without permission problem.
The cacls command line tool can't be used in such situation, because the file does belongs to new user, so it will failed with Access is denied error. and it can't change ownership.
Even if I can change the owership via SubInACL tool, cacls can't remove the old user's permission because the old user does not exist on new installation, and can't copy the old user's permission to new user.
So, can we simply bind old user's SID to new user on the freshly installed Windows ?
Sample test batch
@echo offREM Additional tools used in this scriptREM PsGetSid http://technet.microsoft.com/en-us/sysinternals/bb897417REM SubInACL http://www.microsoft.com/en-us/download/details.aspx?id=23510REMREM make sure these tools are added into PATHset account=MyUserAccountset password=long-passwordset dir=testset file=test.txtecho Creating user [%account%] with password [%password%]...pausenet user %account% %password% /addpsgetsid %account%echo Done !echo Making directory [%dir%] ...pausemkdir %dir%dir %dir%* /qecho Done !echo Changing permissions of directory [%dir%]: only [%account%] and [%UserDomain%\%UserName%] has full access permission...pausecacls %dir% /G %account%:Fcacls %dir% /E /G %UserDomain%\%UserName%:Fdir %dir%* /qcacls %dir%echo Done !echo Changing ownership of directory [%dir%] to [%account%]...pausesubinacl /file %dir% /setowner=%account%dir %dir%* /qecho Done !echo RunAs [%account%] user to write a file [%file%] in directory [%dir%]...pauserunas /noprofile /env /user:%account% "cmd /k echo some text %DATE% %TIME% > %dir%\%file%"dir %dir% /qecho Done !echo Deleting and Recreating user [%account%] (reinstall simulation) ...pausenet user %account% /deletenet user %account% %password% /addpsgetsid %account%echo Done ! %account% is recreated, it has a new SID nowecho Now, use this "same" account [%account%] to access [%dir%], it will failed with "Access is denied"pauserunas /noprofile /env /user:%account% "cmd /k cacls %dir%"REM runas /noprofile /env /user:%account% "cmd /k type %dir%\%file%"echo Done !echo Changing ownership of directory [%dir%] to NEW [%account%]...pausesubinacl /file %dir% /setowner=%account%dir %dir%* /qcacls %dir%echo Done ! As you can see, "Account Domain not found" is actually the OLD [%account%] userecho Deleting user [%account%] ...pausenet user %account% /deleteecho Done !echo Deleting directory [%dir%]...pausermdir %dir% /s /qecho Done !