PowerShell: DataOnTAP and SID Convertions
This morning while standing up a new vScan A/V server I wanted to look up our McAfee service account. I knew the account would be a domain account, and I knew it would be a member of the backup operators group on the filer. With that in mind I ran the following.
[0:4]> Get-NaDomainUser -Group "Backup Operators"
SID
---
S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-112477
S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-111419
S-1-5-21-XXXXXXXX-XXXXXXXXX-XXXXXXXXX-146727
|
Well that’s rather useless… Unfortunately, the OnTAP API doesn’t provide a means to convert a SID to a NTAccount. This is normally accomplished via the “cifs lookup” command on the Ontap CLI, but that doesn’t help us much from the toolkit. Fortunately .Net provides a native means to perform this conversion. This isn’t new to anyone who has been following PowerShell for a while (/\/\o\/\/ first posted these function way back in the Monad days), but that doesn’t make them any less useful!
Function ConvertTo-NTAccount { Param( [Parameter(Mandatory=$true, HelpMessage="Enter the Sid to translate", ValueFromPipeLine=$true, ValueFromPipelineByPropertyName=$true )] [string] $SID ) Process { $SIDObject = New-Object system.security.principal.securityidentifier($SID) write-output $SIDObject.translate([system.security.principal.ntaccount]) } } Function ConvertTo-SID { Param( [Parameter(Mandatory=$true, HelpMessage="Enter the NTAccount to translate in the form of domain\account", ValueFromPipeLine=$true, ValueFromPipelineByPropertyName=$true )] [string] $NTAccount ) Process { $NTAccountObject = New-Object system.security.principal.NtAccount($NTaccount) write-output $NTAccountObject.translate([system.security.principal.securityidentifier]) } } Armed with my trusty functions Let's try this again!
[0:15]> Get-NaDomainUser -Group "Backup Operators" | ConvertTo-NTAccount
Value
-----
GetAdmin\svcAV
GetAdmin\svcBackup
GetAdmin\svcMNV
|
Now that’s more like it! This is what I Love about powershell. In the past I would have had to push back on my sales rep, who would have inturn pushed back on the development team. fast forward a year, and maybe I would have a workaround. Or I would have had to try and glue a couple third party exe together (yuck). With PowerShell if I don’t like something I simply extend it in script. No development, nothing complicated, just a couple line of PowerShell. Best of all I can then provide this to the vendor as a concreate example of what I want in the next release (hint hint NetApp cifs lookup needs to be in the SDK!)
It really is just great stuff.
~Glenn
