Skip to content

Commit 0dbb2bc

Browse files
MichaelGrafnetterMichaelGrafnetter
committed
SID history over MS-DRSR
1 parent 7e43a1c commit 0dbb2bc

29 files changed

+2205
-1084
lines changed

‎Documentation/CHANGELOG.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,13 @@ All notable changes to this project will be documented in this file. The format
77

88
## [Unreleased]
99

10+
- Nothing yet.
11+
12+
## [6.3] - 2026-02-08
13+
1014
### Added
1115

16+
- The [Add-ADReplSidHistory](PowerShell/Add-ADReplSidHistory.md#add-adreplsidhistory) cmdlet for principal SID history migration through the MS-DRSR protocol.
1217
- Instructions and prompts for GitHub Copilot.
1318

1419
### Changed
@@ -699,7 +704,8 @@ This is a [Chocolatey](https://chocolatey.org/packages/dsinternals-psmodule)-onl
699704
## 1.0 - 2015-01-20
700705
Initial release!
701706

702-
[Unreleased]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.2...HEAD
707+
[Unreleased]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.3...HEAD
708+
[6.3]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.2...v6.3
703709
[6.2]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.1.1...6.2
704710
[6.1.1]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.1...v6.1.1
705711
[6.1]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.0.1...v6.1

‎Documentation/PowerShell/Add-ADReplSidHistory.md‎

Lines changed: 227 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,227 @@
1+
---
2+
external help file: DSInternals.PowerShell.dll-Help.xml
3+
Module Name: DSInternals
4+
online version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Add-ADReplSidHistory.md
5+
schema: 2.0.0
6+
---
7+
8+
# Add-ADReplSidHistory
9+
10+
## SYNOPSIS
11+
Adds SID history from a source principal to a destination principal through the MS-DRSR protocol.
12+
13+
## SYNTAX
14+
15+
### CrossForest
16+
```
17+
Add-ADReplSidHistory -SourceDomain <String> -SourcePrincipal <String> [-SourceDomainController <String>]
18+
[-SourceCredential <PSCredential>] -DestinationDomain <String> -DestinationPrincipal <String> -Server <String>
19+
[-Credential <PSCredential>] [<CommonParameters>]
20+
```
21+
22+
### IntraDomain
23+
```
24+
Add-ADReplSidHistory -SourcePrincipal <String> -DestinationPrincipal <String> [-DeleteSourceObject]
25+
-Server <String> [-Credential <PSCredential>] [<CommonParameters>]
26+
```
27+
28+
### CheckSecureChannel
29+
```
30+
Add-ADReplSidHistory [-CheckSecureChannel] -Server <String> [-Credential <PSCredential>] [<CommonParameters>]
31+
```
32+
33+
## DESCRIPTION
34+
This cmdlet wraps the IDL_DRSAddSidHistory RPC call. It passes source and destination principal information to the domain controller and can optionally validate the secure channel or delete the source object.
35+
36+
## EXAMPLES
37+
38+
### Example 1
39+
```powershell
40+
PS C:\> Add-ADReplSidHistory -SourceDomain 'CONTOSO' -SourcePrincipal 'LegacyUser' -SourceDomainController 'CONTOSO-PDC'
41+
-SourceCredential (Get-Credential 'CONTOSO\Administrator') -DestinationDomain 'FABRIKAM'
42+
-DestinationPrincipal 'MigratedUser' -Server 'FABRIKAM-DC1'
43+
```
44+
45+
Adds the SID history of *LegacyUser* from the CONTOSO domain to *MigratedUser* in the FABRIKAM domain.
46+
47+
### Example 2
48+
```powershell
49+
PS C:\> Add-ADReplSidHistory -SourcePrincipal 'CN=LegacyUser,CN=Users,DC=contoso,DC=com'
50+
-DestinationPrincipal 'CN=MigratedUser,CN=Users,DC=contoso,DC=com' -DeleteSourceObject -Server 'CONTOSO-DC1'
51+
```
52+
53+
Adds the SID history of the source object to the destination object in the same domain and deletes the source object.
54+
55+
### Example 3
56+
```powershell
57+
PS C:\> Add-ADReplSidHistory -CheckSecureChannel -Server 'FABRIKAM-DC1'
58+
```
59+
60+
Verifies that the RPC connection to the destination DC is secure.
61+
62+
## PARAMETERS
63+
64+
### -CheckSecureChannel
65+
Verifies whether the channel is secure and returns the result of the verification.
66+
67+
```yaml
68+
Type: SwitchParameter
69+
Parameter Sets: CheckSecureChannel
70+
Aliases:
71+
72+
Required: True
73+
Position: Named
74+
Default value: False
75+
Accept pipeline input: False
76+
Accept wildcard characters: False
77+
```
78+
79+
### -Credential
80+
Specifies a user account that has permission to connect to the destination domain controller. The default is the current user.
81+
82+
```yaml
83+
Type: PSCredential
84+
Parameter Sets: (All)
85+
Aliases:
86+
87+
Required: False
88+
Position: Named
89+
Default value: None
90+
Accept pipeline input: False
91+
Accept wildcard characters: False
92+
```
93+
94+
### -DeleteSourceObject
95+
Appends the source object's SID history to the destination and deletes the source object from the source domain.
96+
97+
```yaml
98+
Type: SwitchParameter
99+
Parameter Sets: IntraDomain
100+
Aliases:
101+
102+
Required: True
103+
Position: Named
104+
Default value: False
105+
Accept pipeline input: False
106+
Accept wildcard characters: False
107+
```
108+
109+
### -DestinationDomain
110+
Specifies the destination domain in which the destination principal resides. The domain name can be an FQDN or a NetBIOS name.
111+
112+
```yaml
113+
Type: String
114+
Parameter Sets: CrossForest
115+
Aliases:
116+
117+
Required: True
118+
Position: Named
119+
Default value: None
120+
Accept pipeline input: False
121+
Accept wildcard characters: False
122+
```
123+
124+
### -DestinationPrincipal
125+
Specifies the destination security principal that receives the source SID history.
126+
127+
```yaml
128+
Type: String
129+
Parameter Sets: CrossForest, IntraDomain
130+
Aliases:
131+
132+
Required: True
133+
Position: Named
134+
Default value: None
135+
Accept pipeline input: True (ByPropertyName)
136+
Accept wildcard characters: False
137+
```
138+
139+
### -Server
140+
Specifies the target domain controller for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address.
141+
142+
```yaml
143+
Type: String
144+
Parameter Sets: (All)
145+
Aliases: Host, DomainController, DC
146+
147+
Required: True
148+
Position: Named
149+
Default value: None
150+
Accept pipeline input: False
151+
Accept wildcard characters: False
152+
```
153+
154+
### -SourceCredential
155+
Specifies the credentials to be used in the source domain.
156+
157+
```yaml
158+
Type: PSCredential
159+
Parameter Sets: CrossForest
160+
Aliases:
161+
162+
Required: False
163+
Position: Named
164+
Default value: None
165+
Accept pipeline input: False
166+
Accept wildcard characters: False
167+
```
168+
169+
### -SourceDomain
170+
Specifies the source domain to query for the SID of the source principal. The domain name can be an FQDN or a NetBIOS name.
171+
172+
```yaml
173+
Type: String
174+
Parameter Sets: CrossForest
175+
Aliases:
176+
177+
Required: True
178+
Position: Named
179+
Default value: None
180+
Accept pipeline input: False
181+
Accept wildcard characters: False
182+
```
183+
184+
### -SourceDomainController
185+
Specifies the primary domain controller (PDC) or PDC role owner in the source domain.
186+
187+
```yaml
188+
Type: String
189+
Parameter Sets: CrossForest
190+
Aliases:
191+
192+
Required: False
193+
Position: Named
194+
Default value: None
195+
Accept pipeline input: False
196+
Accept wildcard characters: False
197+
```
198+
199+
### -SourcePrincipal
200+
Specifies the source security principal whose SID history is to be added. If -DeleteSourceObject is specified, this value should be a DN; otherwise, it should be a domain-relative SAM name.
201+
202+
```yaml
203+
Type: String
204+
Parameter Sets: CrossForest, IntraDomain
205+
Aliases:
206+
207+
Required: True
208+
Position: Named
209+
Default value: None
210+
Accept pipeline input: True (ByPropertyName)
211+
Accept wildcard characters: False
212+
```
213+
214+
### CommonParameters
215+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
216+
217+
## INPUTS
218+
219+
### System.String
220+
221+
## OUTPUTS
222+
223+
### None
224+
225+
## NOTES
226+
227+
## RELATED LINKS

‎Documentation/PowerShell/Readme.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,9 @@ Fetches the specified KDS Root Key through the MS-DRSR protocol.
101101
### [Add-ADReplNgcKey](Add-ADReplNgcKey.md#add-adreplngckey)
102102
Composes and updates the msDS-KeyCredentialLink value on an object through the MS-DRSR protocol.
103103

104+
### [Add-ADReplSidHistory](Add-ADReplSidHistory.md#add-adreplsidhistory)
105+
Adds SID history from a source principal to a destination principal through the MS-DRSR protocol.
106+
104107
### [Get-SamPasswordPolicy](Get-SamPasswordPolicy.md#get-sampasswordpolicy)
105108
Queries Active Directory for the default password policy.
106109

‎Src/DSInternals.ADSI/DSInternals.ADSI.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
3-
<Version>6.2</Version>
3+
<Version>6.3</Version>
44
<AssemblyTitle>DSInternals ADSI Library</AssemblyTitle>
55
</PropertyGroup>
66

‎Src/DSInternals.Common/DSInternals.Common.csproj‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
<!-- NuGet package metadata -->
33
<PropertyGroup>
44
<IsPackable>true</IsPackable>
5-
<Version>6.2</Version>
5+
<Version>6.3</Version>
66
<AssemblyTitle>DSInternals Common Library</AssemblyTitle>
77
<Title>$(AssemblyTitle)</Title>
88
<Description>This package is shared between all other DSInternals packages. Its main features are Azure AD Graph API and ADSI clients for for retrieval of cryptographic material. It contains implementations of common hash functions used by Windows, including NT hash, LM hash and OrgId hash. It also contains methods for SysKey/BootKey retrieval.</Description>
9-
<PackageReleaseNotes>- Migrated from Newtonsoft.Json to System.Text.Json.
10-
- Ported RSA public key operations from .NET Framework to .NET.</PackageReleaseNotes>
9+
<PackageReleaseNotes>- Improved generation of NGC keys to meet January 2026 Windows validation changes.
10+
- Removed Azure AD Graph API-related code.</PackageReleaseNotes>
1111
<PackageTags>ActiveDirectory Security Entra AD AAD Identity Active Directory</PackageTags>
1212
</PropertyGroup>
1313

‎Src/DSInternals.DataStore/DSInternals.DataStore.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22
<!-- NuGet package metadata -->
33
<PropertyGroup>
44
<IsPackable>true</IsPackable>
5-
<Version>6.2</Version>
5+
<Version>6.3</Version>
66
<AssemblyTitle>DSInternals DataStore Library</AssemblyTitle>
77
<Title>$(AssemblyTitle)</Title>
88
<Description>DSInternals DataStore is an advanced framework for offline ntds.dit file manipulation. It can be used to extract password hashes from Active Directory backups or to modify the sIDHistory and primaryGroupId attributes.</Description>
9-
<PackageReleaseNotes>- Fixed a bug in prefix table parsing.</PackageReleaseNotes>
9+
<PackageReleaseNotes>- Updated assembly dependencies.</PackageReleaseNotes>
1010
<PackageTags>ActiveDirectory Security NTDS AD Identity Active Directory</PackageTags>
1111
</PropertyGroup>
1212

‎Src/DSInternals.PowerShell/Chocolatey/dsinternals-psmodule.nuspec‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,10 @@ The DSInternals PowerShell Module has these main features:
3636
## Disclaimer
3737
Features exposed through these tools are not supported by Microsoft. Improper use might cause irreversible damage to domain controllers or negatively impact domain security.</description>
3838
<releaseNotes>
39-
* The New-ADDBRestoreFromMediaScript cmdlet should no longer be throwing the NullReferenceException.
40-
* Disabled DES_CBC_MD5 Kerberos key derivation support due to recent Windows API changes.
41-
* Removed the broken -Protocol parameter from replication cmdlets.
42-
* Due to unexpected delays in code signing certificate renewal, this release is not digitally signed.
39+
* Added the Add-ADReplSidHistory cmdlet for SID history migration via MS-DRSR.
40+
* Improved generation of NGC keys to meet January 2026 Windows validation changes.
41+
* Removed Azure AD Graph API-related cmdlets.
42+
* Merged the *.psm1 script bootstrapper of the binary PowerShell module into the *.psd1 module manifest.
4343
</releaseNotes>
4444
<dependencies>
4545
<!-- Windows Management Framework 5.1+. For OS prior to Windows 10 and Windows Server 2016. -->

0 commit comments

Comments
 (0)