The challenge was that this information is stored differently in XP and Vista\Win7 in the registry and the Profile information is accessible on Vista\Win7 systems using Get-Profiles, but needs some registry scripting jiggery-pokery for XP\Win2k3 systems. Additionally, I could not find any script out there that did both these things, so I decided to use functions from other peoples work and stitch them together to get what is attached.

To understand what can be done with the script, read the header. If the script is run without parameters it will just get Profile information for all desktop systems in the currently logged on domain. The output is stored in 3 csv files that are suffixed with Date\Time stamps in the same location that the script is run from.

 The Syntax for running the script is this and none of the parameters are required.

.\Get-PCUserProfilePath.ps1 -srcDomainPath <SearchPathdnOrDNSName> -IterationDelay <TimeInSeconds> -ComputerType <ServerOrDesktop> -ComputerListFile <sAMAccountNameTextList>
 

I have not included a listing of the script here because it is too large, but the script can be downloaded at the bottom of this posting.

HTH

Get-PCsUserProfileInfo.ps1.txt

Back to this problemette I was presented with. Following a user migration process\procedure the AD support team had discovered that a number of users were not able to access some resources and as one of the checks during remediation, wanted a quick way of comparing a users Group Membership with that of the source account. The following script is what I came up with for them. Basically, it gets all the direct Group memberships for the source object and destination objects (as specified at the command line) and runs a compare operation. The on screen output is of a table that displays the Group Memberships that are different between the objects with an arrow indicator showing what side of the evaluation the Group Membership exists. So for example if you ran the following command :

.\Compare-UserGroups.ps1 -srcDomain domain1.local -destDomain woodgrovebank.com -srcsAMAccountName carlh1 -destsAMAccountName carlh2

You would get 2 files that list each objects Group Membership and something like the table below, which shows that the entry for destsAMAccountName (carlh2) is a member of a group named "Password Policy Group", which the entry for srcsAMAccountName (carlh) is not a member of and vice versa for the other groups.

 InputObject                                       SideIndicator                                                                       
-----------                                            -------------                                                                       
Password Policy Group                     =>                                                                                  
EventLogAccess                                <=                                                                                  
DnsAdmins                                        <=                                                                                  
Backup Operators                             <=                                                                                  

It is true this is just a "like for like" sAMAccountName comparison and not a true SID to SID\SIDHistory comparison and it only compares Direct membership, but the requirement was for a quick check to ensure nothing was awry for odd troubleshooting instances and suits the needs where Groups have been migrated wholesale. If you need anything more funky that does Group Nesting then I advise you pop over to here https://www.rlmueller.net/freecode1.htm . Richards scripts are awesome.

<#
####################################################################
 Compare-UserGroups.ps1

 Syntax:  Compare-UserGroups.ps1 -srcDomain <SourceDomain> -destDomain <DestinationDomain> -srcsAMAccountName <UserNetbiosName> -destsAMAccountName <UserNetbiosName>

 Example: Compare-UserGroups.ps1 -srcDomain domain1.local -destDomain woodgrovebank.com -srcsAMAccountName carlh -destsAMAccountName carlh

 Purpose: Compares the DIRECT Group Membership of 2 user accounts.
          Be aware that it compares the Netbios names (sAMAccountName) of the groups
          and is only useful either within a domain\forest or after a migration
          of a user account between domains where the group names have not been changed
          as a consequence of the migration.

 Params:  As shown in syntax above or by typing the script name at the command prompt

 Req:     Windows 2003 SP2 or above, Powershell V2.
          run "set-executionpolicy remotesigned" in Powershell

          https://blogs.technet.com/b/carlh

 Author:  Carl Harrison

    This script is provided "AS IS" with no warranties, confers no rights and
    is not supported by the authors or authors employer.
    Use of this script sample is subject to the terms specified at
    https://www.microsoft.com/info/copyright.mspx.

 Version: 1.0 - First cut

####################################################################
#>

Param (
 [Parameter()][string]$srcDomain='',
 [Parameter()][String]$destDomain='',
    [Parameter()][String]$srcsAMAccountName='',
    [Parameter()][String]$destsAMAccountName='')

Function Compare-GroupsHelp () {
$helptext=@"
NAME: Compare-UserGroups.ps1

Compares the DIRECT Group Membership of 2 user accounts
Be aware that it compares the Netbios names (sAMAccountName) of the groups
and is only useful either within a domain\forest or after a migration
of a user account between domains where the group names have not been changed
as a consequence of the migration.

PARAMETERS:
-srcDomain          Source Domain (Required)
-destDomain         Destination Domain (Required)
-srcsAMAccountName  Netbios name of the user account in the source domain (Required)
-destsAMAccountName Netbios name of the user account in the destination domain (Required)

SYNTAX:
Compare-UserGroups.ps1 -srcDomain domain1.local -destDomain woodgrovebank.com -srcsAMAccountName carlh -destsAMAccountName carlh2

Thsi compares the group memberships that carlh from domain1.local has in domain1.local
with the group memberships that carlh from woodgrovebank.com has in woodgrovebank.com

"@
$helptext
exit
}

Function Get-LDAPUser ($UserName, $SourceDomain) {
    $domain1 = new-object DirectoryServices.DirectoryEntry ("LDAP://$SourceDomain")
    $searcher = new-object DirectoryServices.DirectorySearcher($domain1)
    $searcher.filter = "(&(objectClass=user)(sAMAccountName= $UserName))"
    $searcher.findone().getDirectoryEntry()
    $domain1 =""
}

if(!($srcDomain)) {"Source Domain Required";Compare-GroupsHelp}
if(!($destDomain)) {"Destination Domain Required";Compare-GroupsHelp}
if(!($srcsAMAccountName)) {"Netbios Name or Source Account Required";Compare-GroupsHelp}
if(!($destsAMAccountName)) {"Netbios Name or Destination Account Required";Compare-GroupsHelp}

$srcUserGroupsFile = '.\srcUserGroupsFile.txt'
$destUserGroupsFile = '.\destUserGroupsFile.txt'

Write-Host
$srcUser = get-ldapuser $srcsAMAccountName $srcDomain
Write-Host $srcUser.displayName "is a member of" $srcUser.memberOf.Count " groups in domain $srcDomain. The groups are:"
$srcUser.memberOf | ft
Write-Host
$destUser = get-ldapuser $destsAMAccountName $destDomain
Write-Host $destUser.displayName "is a member of" $destUser.memberOf.Count " groups in domain $destDomain. The groups are:"
$destUser.memberOf | ft

Write-Host

$srcUserGroups = @()
$srcGroupsDN = @()
$destUserGroups = @()
$destGroupsDN = @()

Foreach($Group in $srcUser.memberOf)
    {
    $GroupsAMAccountName = ([ADSI]"LDAP://$Group").sAMAccountName.value
    #$GroupsAMAccountName
    $srcUserGroups += "$GroupsAMAccountName"
    $srcGroupsDN += $Group.tostring()
    }
Foreach($Group in $destUser.memberOf)
    {
    $GroupsAMAccountName = ([ADSI]"LDAP://$Group").sAMAccountName.value
    #$GroupsAMAccountName
    $destUserGroups += "$GroupsAMAccountName"
    $destGroupsDN += $Group.tostring()
    }

$srcGroupsDN | Out-File $srcUserGroupsFile
$destGroupsDN | Out-File $destUserGroupsFile

Compare-Object $srcUserGroups $destUserGroups -SyncWindow 100

$destUser = ""
$srcUser = ""

Compare-UserGroups.ps1.txt

The script below gives a remedy to this by taking as a command line parameter the name and domain of one domain user and copying profile settings (the Profile Path, Home Drive & Directory, and Script Path) to relevant attributes of another command line parameter specified user name (in another domain). I even included the ability to prefix the ScriptPath Attribute (in case you use a different folder tree in the new domain).

Before using the script read the header to give you a clue as to the syntax. I have attached a copy of the code in a text file at the bottom of this post.

<#
####################################################################
Copy-UserProfile.ps1

Syntax:  Copy-UserProfile.ps1 -srcDomain <SourceDomain> -destDomain <DestinationDomain> -scriptPathPrefix <ScriptPrefix> -srcsAMAccountName <UserNetbiosName> -

destsAMAccountName <UserNetbiosName>

Example: Copy-UserProfile.ps1 -srcDomain domain1.local -destDomain woodgrovebank.com -scriptPathPrefix domain1\ -srcsAMAccountName carlh -destsAMAccountName carlh2

Purpose: This Sets the ProfilePath, ScriptPath, HomeDrive and HomeDirectory of the user carlh2 in the
          Woodgrovebank.com domain to the same settings as those for carlh in domain.local. Additionally,
          the scriptPath attribute content is prefixed with the word domin1\

Params:  As shown in syntax above or by typing the script name at the command prompt

Req:     Windows 2003 SP2 or above, Powershell V2.
  run "set-executionpolicy remotesigned" in Powershell

  https://blogs.technet.com/b/carlh

Author:  Carl Harrison

    This script is provided "AS IS" with no warranties, confers no rights and
    is not supported by the authors or Microsoft Corporation.
    Use of this script sample is subject to the terms specified at
    https://www.microsoft.com/info/copyright.mspx.

Version: 1.0 - First cut

####################################################################
#>

Param (
 [Parameter()][string]$srcDomain='',
 [Parameter()][String]$destDomain='',
        [Parameter()][String]$scriptPathPrefix='',
        [Parameter()][String]$srcsAMAccountName='',
        [Parameter()][String]$destsAMAccountName='')

Function GetSetUserHelp () {
$helptext=@"
NAME: Copy-UserPofile.ps1
Used to copy User Profile, Logon Script and Home details of user
from one domain to the next.

PARAMETERS:
-srcDomain          Source Domain (Required)
-destDomain         Destination Domain (Required)
-scriptPathPrefix   Prefix to add to Script Path attribute (include any back slashes or forward slashes as required)
-srcsAMAccountName  Netbios name of the user account in the source domain (Required)
-destsAMAccountName Netbios name of the user account in the destination domain (Required)

SYNTAX:
Copy-UserProfile.ps1 -srcDomain domain1.local -destDomain woodgrovebank.com -scriptPathPrefix domain1\ -srcsAMAccountName carlh -destsAMAccountName carlh2

This Sets the ProfilePath, ScriptPath, HomeDrive and HomeDirectory of the user carlh2 in the
Woodgrovebank.com domain to the same settings as those for carlh in domain.local. Additionally,
the scriptPath attribute content is prefixed with the word domin1\

"@
$helptext
exit
}

Function Get-LDAPUser ($UserName, $SourceDomain) {
    $domain1 = new-object DirectoryServices.DirectoryEntry ("LDAP://$SourceDomain")
    $searcher = new-object DirectoryServices.DirectorySearcher($domain1)
    $searcher.filter = "(&(objectClass=user)(sAMAccountName= $UserName))"
    $searcher.findone().getDirectoryEntry()
    $domain1 =""
}

Function Set-LDAPUser ($UserName2, $DestinationDomain) {
    $domain2 = new-object DirectoryServices.DirectoryEntry ("LDAP://$DestinationDomain")
    $searcher = new-object DirectoryServices.DirectorySearcher($domain2)
    $searcher.filter = "(&(objectClass=user)(sAMAccountName= $UserName2))"
    $destUser = $searcher.findone().getDirectoryEntry()
    $destUser.scriptPath = "$Global:ScriptPathPrefix" + $Global:srcUser.scriptPath
    $destUser.profilePath = $Global:srcUser.profilePath
    $destUser.homeDrive = $Global:srcUser.homeDrive
    $destUser.homeDirectory = $Global:srcUser.homeDirectory
    $destUser.setinfo()
    $domain2 = ""
}

if(!($srcDomain)) {"Source Domain Required";GetSetUserHelp}
if(!($destDomain)) {"Destination Domain Required";GetSetUserHelp}
if(!($srcsAMAccountName)) {"Netbios Name or Source Account Required";GetSetUserHelp}
if(!($destsAMAccountName)) {"Netbios Name or Destination Account Required";GetSetUserHelp}

$Global:ScriptPathPrefix = $ScriptPathPrefix
$Global:srcUser = get-ldapuser $srcsAMAccountName $srcDomain
Write-Host $Global:srcUser.displayName "in domain $srcDomain settings are:"
$Global:srcUser.scriptPath
$Global:srcUser.profilePath
$Global:srcUser.homeDrive
$Global:srcUser.homeDirectory
set-ldapuser $destsAMAccountName $destDomain
$Global:destUser = get-ldapuser $destsAMAccountName $destDomain
Write-Host ""
Write-Host $Global:destUser.displayName "in domain $destDomain settings are now:"
$Global:destUser.scriptPath
$Global:destUser.profilePath
$Global:destUser.homeDrive
$Global:destUser.homeDirectory

$Global:destUser = ""
$Global:srcUser = ""
$ScriptPathPrefix = ""

Copy-UserProfile.ps1.txt

It is rather rudimentary and could actually be made a bit more usable by getting it to search AD and even specific OU structures in AD. Examples of this follow later in my TechNet Blog.

Script attached to blog below (requires removal of txt extension to work).

<#
#####################################################################
SCRIPT IsADMemberOfLocalAdmins.ps1

SYNTAX
.\IsADMemberOfLocalAdmins.ps1 -InputFile <.\ComputerList.txt> -OutputFile <.\OutPutFile.txt>

-InputFile          Text file containing list of Computers to query
                   
-OutputFile         Text File containing results from script

SYNOPSIS
Queries the Local Administrators group on the computers listed in the
text file provided as a parameter, to determine if Domain Admins is
listed as a member.

NOTE
    Script requires no parameters or arguments, but does have some.
    I recommend you have the relevant permissions in the domain and
    on the computers being queried for optimal results.

    This script is provided "AS IS" with no warranties, confers no rights and
    is not supported by the authors or employer.

AUTHOR
    Carl Harrison

VERSION: 1.0 - First cut
#####################################################################
#>

# Change these two to suit your needs
Param (
  [Parameter()][string]$InputFile='.\computers.txt',
  [Parameter()][String]$OutputFile='.\IsDAMemberOfAdminsOutput.txt')

$ChildGroups = "Domain Admins"
$LocalGroup = "Administrators"

$MemberNames = @()
$OutPutResults = @()
$Computers = Get-Content $InputFile
foreach ( $Computer in $Computers ) {
 $Group= [ADSI]"WinNT://$Computer/$LocalGroup,group"
 $Members = @($Group.psbase.Invoke("Members"))
 $Members | ForEach-Object {
  $MemberNames += $_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)
 }
 $ChildGroups | ForEach-Object {
  $output = "" | Select-Object Computer, Group, InLocalAdmin
  $output.Computer = $Computer
  $output.Group = $_
  $output.InLocalAdmin = $MemberNames -contains $_
  Write-Output $output
        $OutputResults += $output
    }
    $MemberNames = @()
}
$OutputResults | Export-CSV -NoTypeInformation $OutputFile

IsDAMemberOflocalAdmins.ps1.txt

Below is a listing of the VBScript. It reads in a file named Groups.csv that contains a list of all groups (sAMAccountName's) to be deleted (the original CSV file also had a second column that had the group type integer, but the script strips this). The script works in the domain of the currently logged on credentials, so you need the necessary permissions in AD for it to work.

Normally, I comment my scripts a lot more, but this was a rush order :-) and I haven't had the time to revisit it (and I an trying to move from VBScript now).

My colleague has proven, the script is easily altered to enable it t delete any type of object and these scripts have been posted to Microsoft Script Center.

'Script deletes security groups from a csv file.
'csv format is strsAMGroupName,Whatever
'This script is offered with no warranty
'On Error Resume Next 'used in case group not found
Option Explicit

Const ForReading = 1

Dim strL, spl1, strOU, strGroupCN, strGroupName
Dim objFSO, objInputFile

Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objInputFile = objFSO.OpenTextFile(".\groups.csv", ForReading) 'your csv file

wscript.echo "script started"

'extract from csv file
Do until objInputFile.AtEndOfStream
 strL = objInputFile.ReadLine
 spl1 = Split(strL, ",")
 strGroupName = (spl1(0))
 If GroupExists(strGroupName) = True Then
  'WScript.Echo strGroupName & " exists."
  DelGroup
 End If   
Loop

Set objFSO = Nothing
Set objInputFile = Nothing

wscript.echo "script finished"

'group exist check
Function GroupExists(strsAMGroupName)

Dim strDNSDomain, strFilter, strQuery
Dim objConnection, objCommand, objRootLDAP, objLDAPGroup, objRecordSet

GroupExists = False
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
Set objRootLDAP = GetObject("LDAP://RootDSE")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection
objCommand.Properties("Page Size") = 1000
'objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE

strDNSDomain = objRootLDAP.Get("DefaultNamingContext")
strFilter = "(&(objectCategory=group)(sAMAccountName=" & strsAMGroupName & "))"

strQuery = "<LDAP://" & strDNSDomain & ">;" & strFilter & ";sAMAccountName,adspath,CN;subTree"

objCommand.CommandText = strQuery
'WScript.Echo strFilter
'WScript.Echo strQuery
Set objRecordSet = objCommand.Execute

If objRecordSet.RecordCount = 1 Then

objRecordSet.MoveFirst
    'WScript.Echo "We got here " & strsAMGroupName     
 'WScript.Echo objRecordSet.Fields("sAMAccountname").Value
 'WScript.Echo objRecordSet.Fields("adspath").Value
 If objRecordSet.Fields("sAMAccountname").Value = strsAMGroupName Then
  GroupExists = True
  Set objLDAPGroup = GetObject(objRecordSet.Fields("adspath").Value)
  strOU = objLDAPGroup.Parent
  strGroupCN = objRecordSet.Fields("CN").Value
 End If
Else
 WScript.Echo strsAMGroupName & " Group doesn't exist or Duplicate sAMAccountName"
 GroupExists = False
 strGroupCN = ""
 strOU = ""
End If

objRecordSet.Close
Set objConnection = Nothing
Set objCommand = Nothing
Set objRootLDAP = Nothing
Set objLDAPGroup = Nothing
Set objRecordSet = Nothing

end function

Sub DelGroup

Dim objOU

'WScript.Echo strOU
'WScript.Echo strGroupCN
Set objOU = GetObject(strOU)
objOU.Delete "Group", "cn=" & strGroupCN & ""
WScript.Echo strGroupName & " (CN=" & strGroupCN & ") has been deleted."

Set ObjOU = Nothing
strGroupCN = ""

End Sub

Bulkdeletegroups.vbs.txt

So my first offering is something I wrote for a colleague of mine, that queries all the Windows Servers in your domain and gathers their Shares, the permissions set on the shares and the permissions set on the NTFS file system at the share level (not lower). All this is output to 2 CSV files in the same folder that the script is run from. There are no Parameters for the script, and I hadn't written it to specifically search in specific OU structures or to read from text file based list of computers. I have since written another script that I will be posting here, that has this functionality, so if you need it that functionality it can be done.

The script requires that you have the necessary Rights on all the Servers you will be querying to get back all the information.

Below is a listing of the script, but I have attached the code in a text file as well (obviously remove the txt extension to use)..

<#
#####################################################################
SCRIPT GetPermissions.ps1
SYNOPSIS
    Gets all Servers from the domain from which the script is run in
    (i.e. the domain you are logged in to).
    Then uses the server list to query each servers Share permissions
    and the NTFS permissions of each share root folder.
    The Script creates 2 files in the same location the script is
    run from (sharereport.csv and ntfsreport.csv).
NOTE
    Script requires no parameters or arguments
    I recommend you have the relevant permissions in the domain and
    on the servers being queried for optimal results.
    Myself or my employer do not warrantee this script in any way and
    use of it is entirely at the users own risk.
    The working functions of this script are taken from examples found
    at Microsoft Script Center web site and are written by Boe Prox.
AUTHOR
    Carl Harrison
    The script utilises 2 functions written by Boe Prox and publically
    available at Microsoft Script Center. They have been altered slightly
    to work with this script.
VERSION: 1.0 - First cut
         1.1 - Sorted FQDN Ping instead of netbios ping
#####################################################################
#>

function Get-SharePermissions{
<# 
.SYNOPSIS 
    Retrieves share permissions. This function was extracted from a
    Powershell Module written by Boe Prox named FileSharePermissions.psm1
.DESCRIPTION
    Retrieves share permissions.
.PARAMETER computer
    Name of server to test.         
.EXAMPLE 
    Get-SharePermissions -computer Test         
#>
[cmdletbinding(
 DefaultParameterSetName = 'computer',
 ConfirmImpact = 'low'
)]
    Param(
        [Parameter(
            Mandatory = $True,
            Position = 0,
            ParameterSetName = 'computer',
            ValueFromPipeline = $True)]
            [array]$computer                     
            )
Begin
    {               
    #Process Share report
    $sharereport = @()
    }
Process
    {
    #Iterate through comptuers
    ForEach ($c in $computer)
        {
        Try
            {   
            #Write-Verbose "Computer: $($c)"
            #Retrieve share information from comptuer
            $ShareSec = Get-WmiObject -Class Win32_LogicalShareSecuritySetting -ComputerName $c -ea stop
            ForEach ($Shares in $sharesec)
                {
                #Write-Verbose "Share: $($Shares.name)"
                    #Try to get the security descriptor
              $SecurityDescriptor = $ShareS.GetSecurityDescriptor()
                    #Iterate through each descriptor
              ForEach ($DACL in $SecurityDescriptor.Descriptor.DACL)
                        {
                        $arrshare = New-Object PSObject
                        $arrshare | Add-Member NoteProperty Computer $c
               $arrshare | Add-Member NoteProperty Name $Shares.Name
               $arrshare | Add-Member NoteProperty ID $DACL.Trustee.Name
                        #Convert the current output into something more readable
               Switch ($DACL.AccessMask)
                            {
                2032127 {$AccessMask = "FullControl"}
                1179785 {$AccessMask = "Read"}
                1180063 {$AccessMask = "Read, Write"}
                1179817 {$AccessMask = "ReadAndExecute"}
                -1610612736 {$AccessMask = "ReadAndExecuteExtended"}
                1245631 {$AccessMask = "ReadAndExecute, Modify, Write"}
                1180095 {$AccessMask = "ReadAndExecute, Write"}
                268435456 {$AccessMask = "FullControl (Sub Only)"}
                default {$AccessMask = $DACL.AccessMask}
                   }
               $arrshare | Add-Member NoteProperty AccessMask $AccessMask
                        #Convert the current output into something more readable
               Switch ($DACL.AceType)
                            {
                0 {$AceType = "Allow"}
                1 {$AceType = "Deny"}
                2 {$AceType = "Audit"}
                   }
               $arrshare | Add-Member NoteProperty AceType $AceType
                        #Add to existing array
                        $sharereport += $arrshare
                        }
              }
                }
            #Catch any errors               
            Catch
                {
                $arrshare = New-Object PSObject
                $arrshare | Add-Member NoteProperty Computer $c
       $arrshare | Add-Member NoteProperty Name "NA"
       $arrshare | Add-Member NoteProperty ID "NA"
                $arrshare | Add-Member NoteProperty AccessMask "NA"         
                #Add to existing array
                $sharereport += $arrshare
                }
            Finally
                {
                #Do Nothing Currently
                }                                                  
            }
        }                      
End {
    #Display report
    #$ShareReport
    #$ShareReport | Export-Csv -notypeinformation "sharereport.csv"
    return $sharereport
    }
}   

function Get-ShareNTFSPermissions{
<# 
.SYNOPSIS 
    Retrieves NTFS permissions on a share. This function was extracted from a
    Powershell Module written by Boe Prox named FileSharePermissions.psm1
.DESCRIPTION
   Retrieves NTFS permissions on a share.
.PARAMETER computer
    Name of server to test.         
.EXAMPLE 
    Get-ShareNTFSPermissions -computer Test       
#>
[cmdletbinding(
 DefaultParameterSetName = 'computer',
 ConfirmImpact = 'low'
)]
    Param(
        [Parameter(
            Mandatory = $True,
            Position = 0,
            ParameterSetName = 'computer',
            ValueFromPipeline = $True)]
            [array]$computer                     
            ) 
Begin
    {             
    #Process NTFS Share report               
    $ntfsreport = @()     
    }
    Process
    {
    #Iterate through each computer
    ForEach ($c in $computer)
        {
        Try
            {                
            Write-Verbose "Computer: $($c)"
            #Gather share information
            $shares = Gwmi -comp $c Win32_Share -ea stop | ? {$_.Name -ne 'ADMIN$'-AND $_.Name -ne 'C$' -AND $_.Name -ne 'IPC$'} | Select Name,Path
            ForEach ($share in $shares)
                {
                #Iterate through shares
                Write-Verbose "Share: $($share.name)"
                If ($share.path -ne "")
                    {
                    #Retrieve ACL information from Share 
                    $remoteshare = $share.path -replace ":","$"
                    Try
                        {
                        #Gather NTFS security information from each share
                        $acls = Get-ACL "\\$computer\$remoteshare"
                        #iterate through each ACL
                        ForEach ($acl in $acls.access)
                            {
                            If ($acl.FileSystemRights -match "\d")
                                {
                       Switch ($acl.FileSystemRights)
                                    {
                        2032127 {$AccessMask = "FullControl"}
                        1179785 {$AccessMask = "Read"}
                        1180063 {$AccessMask = "Read, Write"}
                        1179817 {$AccessMask = "ReadAndExecute"}
                        -1610612736 {$AccessMask = "ReadAndExecuteExtended"}
                        1245631 {$AccessMask = "ReadAndExecute, Modify, Write"}
                        1180095 {$AccessMask = "ReadAndExecute, Write"}
                        268435456 {$AccessMask = "FullControl (Sub Only)"}
                        default {$AccessMask = "Unknown"}
                           }                               
                                }
                            Else
                                {
                                $AccessMask = $acl.FileSystemRights
                                }                               
                            $arrntfs = New-Object PSObject                   
                            #Process NTFS Report        
                            $arrntfs | Add-Member NoteProperty Computer $c             
                            $arrntfs | Add-Member NoteProperty ShareName $Share.name
                            $arrntfs | Add-Member NoteProperty Path $share.path
                            $arrntfs | Add-Member NoteProperty NTFS_User $acl.IdentityReference
                            $arrntfs | Add-Member NoteProperty NTFS_Rights $AccessMask
                            $ntfsreport += $arrntfs
                            }   
                        }
                    Catch
                        {
                        $arrntfs = New-Object PSObject                   
                        #Process NTFS Report        
                        $arrntfs | Add-Member NoteProperty Computer $c             
                        $arrntfs | Add-Member NoteProperty ShareName "NA"
                        $arrntfs | Add-Member NoteProperty Path "NA"
                        $arrntfs | Add-Member NoteProperty NTFS_User "NA"
                        $arrntfs | Add-Member NoteProperty NTFS_Rights "NA"                   
                        #Add to existing array
                        $ntfsreport += $arrntfs
                        }
                    Finally
                        {
                        #Do nothing currently
                        }                                                                                  
                    }                              
                }
            }
        Catch
            {
            $arrntfs = New-Object PSObject
            $arrntfs | Add-Member NoteProperty Computer $c             
            $arrntfs | Add-Member NoteProperty ShareName "NA"
            $arrntfs | Add-Member NoteProperty Path "NA"
            $arrntfs | Add-Member NoteProperty NTFS_User "NA"
            $arrntfs | Add-Member NoteProperty NTFS_Rights "NA"        
            #Add to existing array
            $ntfsreport += $arrntfs        
            }
        Finally
            {
            #Do Nothing Currently
            }                                       
        }           
    }
    End
    {
    #Display report
    #$ntfsreport
    #$ntfsreport | Export-Csv -notypeinformation "ntfsreport.csv"
    return $ntfsreport
    }            
}

#THIS IS THE START OF THE SCRIPT

#Define Some variables and Arrays
$strOperatingSystem = "*Server*"
$Servers = @()
$ServersShareReport = @()
$ServersNTFSReport = @()

#Set up the Directory Search parameters
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.Filter = ("OperatingSystem=$strOperatingSystem")
$objSearcher.PageSize = 1000
 
#Define the Attributes we need from the search
$colProplist = "name","dnshostname","operatingsystemversion"
#Do the Search
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}
$colResults = $objSearcher.FindAll()
$Ping = New-Object System.Net.NetworkInformation.Ping
ForEach ($objResult in $colResults)
    {
    $Server = $objResult.Properties.name
    $ServerDNS = $objResult.Properties.dnshostname
    Write-Host "Pinging $ServerDNS"
    $errorActionPreference="SilentlyContinue"
    $Pingy = $ping.send($ServerDNS,5000)
    $ServerShareOutput = $Null
    $ServerNTFSOutput = $Null
    Try
        {
        #This is where we go get the information
        If ($Pingy.status.tostring() –eq “Success”)
            {
            #Cool we can get to the server now lets gather some information
            write-host “$Server Available”
            $errorActionPreference="Continue"
            $ServerShareOutput = Get-SharePermissions -computer $ServerDNS
            $ServerNTFSOutput = Get-ShareNTFSPermissions -computer $ServerDNS
            $ServersShareReport += $ServerShareOutput
            $ServersNTFSReport += $ServerNTFSOutput
            }
        else
            {
            #oh-oh either WMI is restricted or we cannot get to the current server
            write-host “$Server Not Available"
            $FailedShareServer = New-Object PSObject
            $FailedShareServer | Add-Member NoteProperty Computer "$Server"
            $FailedShareServer | Add-Member NoteProperty Name "Server No Available"
            $ServersShareReport += $FailedShareServer
            $FailedNTFSServer = New-Object PSObject
            $FailedNTFSServer | Add-Member NoteProperty Computer "$Server"
            $FailedNTFSServer | Add-Member NoteProperty ShareName "Server No Available"
            $ServersNTFSReport += $FailedNTFSServer
            }
        }
    Catch
        {
        #And this just catches any weird error events
        write-host “$Server Not Available"
        $FailedShareServer = New-Object PSObject
        $FailedShareServer | Add-Member NoteProperty Computer "$Server"
        $FailedShareServer | Add-Member NoteProperty Name "Server Not Available"
        $ServersShareReport += $FailedShareServer
        $FailedNTFSServer = New-Object PSObject
        $FailedNTFSServer | Add-Member NoteProperty Computer "$Server"
        $FailedNTFSServer | Add-Member NoteProperty ShareName "Server Not Available"
        $ServersNTFSReport += $FailedNTFSServer
        }
    Finally
        {
        $errorActionPreference="Continue"
        $pingy = $null
        $Server = $Null
        }
    }
       
#Now we have the data let's save it to file - in the same location the script is run from
$ServersShareReport | Export-Csv -notypeinformation ".\sharereport.csv"
$ServersShareReport = @()
$ServersNTFSReport | Export-Csv -notypeinformation ".\ntfsreport.csv"
$ServersNTFSReport = @()

GetPermissions.ps1.txt

Funnily enough, I had to use parts of this same method to recover a couple of Hyper-V guests on my PC when I had done some disk volume management and moved the VHD's and config files around a bit, which caused permissions changes obviously; honestly guv'nor I had forgotten I had these guests running from the said volume (I know Best Practice and all that ;-) , but it is just my laptop and not a production service providing environment).

My colleague then commented that it would be cool if such a process were to be scripted. Tada ...... "his wish was my command". To be honest I had put this on my list of things to do, to get me to extend my scripting skills from VBScript to Powershell and having to actually go through the process myself made me agree with my colleague a script would be so much easier and useful to anybody else having to do it. There may actually be another script out there that does this, but at least I actually got to do some Powershell scripting :-) . It may not be the most correctly written script, but it is my first crack of the whip (as the saying goes). There is currently no error trapping and\or exception handling, but I have provided some command line markers that should make it easier to determine at which points it fails (if it does). I intend adding error handling later, but if I didn't share the script now it would always be sat on my laptop as a work in progress without being used (and tested).

What I must say is, that after recovering the Hyper-V Guest using this script, the Hyper-V Guest is in an unsupported state and it is highly recommended that before starting the guest OS, you should use Hyper-V Manager to Export the Guest, remove it from Hyper-V Manager and then Import again into Hyper-V Manager. This will set all the permissions on all files as they should be.

This script definitely works with Windows Server 2008 R2 Hyper-V and I suspect it also works on Windows Server 2008 (I don't have a n environment to check this though). The script utilises icacls and mklink (both provided as command line applications with the OS), because I was unable to use inbuilt Powershell functionality without some deep coding knowledge (not quite there yet) requiring that I write some additional libraries that someone has actually already made available here https://pscx.codeplex.com/ . Basically, the Powershell cmdlet Set-ACL is not able to change owner when setting permissions on certain types of files and folders, this requires some special jiggery-pockery of which I am not yet averse. You may ask why I didn't decide to use the PSCX myself; well I thought it best to produce a script that is standalone and does not require anything that is not already available through Powershell.

Additionally, the script will only work correctly if the volume paths (i.e. drive letters) are the same as from before the issue that caused the Hyper-V guests to be disconnected from the Hyper-V Host Management Services.

The only other thing you will need to do when using this script is to open Powershell with elevated privileges and to run "set-executionpolicy remotesigned".

It may be worth checking the formatting of the code if you copy and paste it from this page as some of the lines have wrapped to the next line on this page. Alternatively, just download the txt file at the bottom of this post.

Enjoy. Oh and please provide feedback if it works or not for you.

####################################################################
# Recover-VM.ps1
#
# Syntax:  Recover-VM.ps1 "<drive:\path\VM_Config_File_as_GUID.xml>"
#          (Use quotes in the argument)
#
# Example: Recover-VM.ps1 "v:\VirtualMachine1\Virtual Machines\7660AA46-BA41-4171-8820-CDD7C71050A0.xml"
#
# Purpose: Creates Symbolic Links and sets the required permissions
#          to make a Hyper-V Virtual Machine available in Hyper-V
#          Management Console. This script is intended for use in
#          recovery scenario where a Virtual Guests files have been
#          manually moved to another Virtual Server, but the volume
#          drive mappings are the same, only.
#          The methodology that this script employs is as discussed
#          in the below blog.
#          It should be noted that once this script has been used
#          the Virtual Guest is in an unsupported state and should
#          be exported and re-imported in Hyper-V Manager to
#          correctly set all the Virtual Machines permissions.
#
# Params:  The drive, folder and filename of the Virtual Machine
#          xml configuration file.
#
# Req:     Windows 2008 or above, Powershell V2, mklink, icacls.
#          run "set-executionpolicy remotesigned" in Powershell
#
# Ref:     https://blogs.msdn.com/b/robertvi/archive/2008/12/19/howto-manually-add-a-vm-configuration-to-hyper-v.aspx
#          https://blogs.technet.com/b/carlh
#
# Author:  CarlH
#
# Myself or my employer do not warantee this script in any way and use
# of it is entirely at the users own risk. The script is intended to
# Recover Virtual Machines only in a recovery scenario, and such VM's
# should be exported and imported onto the Hyper-V server to ensure
# a supported state.
#
# Version: 1.0 - First cut
#
####################################################################

Param($VMConfigFile)

Write-Host ""
Write-Host "---------------Recover-VM Script Start"
$SystemDrive = (Get-item env:systemdrive).Value
$VMFolder = (Get-Item $VMConfigFile).directoryname
$VMFolder = (Get-Item $VMFolder).parent
$VMFolderName = $VMFolder.fullname
Write-Host ""

#Read from the VM Configuration file. VM GUID for Service account. VM Name.
Write-Host "---------------Reading VM Configuration File"
[xml]$VMXML = Get-Content $VMConfigFile
$VMSvcAccount = $VMXML.configuration.properties.global_id."#text"
$VMName = $VMXML.configuration.properties.name."#text"
Write-Host "---------------Completed reading VM Configuration File"
Write-Host ""

#This function takes a file name including the full path as a ThisItem string parameter and gets the current ACL.
#It adds the VM Service account to the current ACL and then Sets the new ACL
function SetACL
{
    Param($ThisItem)
    Write-Host ""
    Write-Host "---------------Setting Permissions for $ThisItem"
    Write-Host ""
    $Acl = Get-Acl $ThisItem
    $AccessRule = New-Object  system.security.accesscontrol.filesystemaccessrule("NT VIRTUAL MACHINE\$VMSvcAccount","FullControl","Allow")
    $Acl.SetAccessRule($AccessRule)
    Set-Acl $ThisItem $Acl  
    Write-Host ""
    Write-Host "---------------Finished Permissions for $ThisItem"
}

#This Function uses the cmd line utility mklink to create a symbolic link of the physical file passed to it in the HardFile parameter as a string
#The LinkLocation string parameter defines what folder the link will be created in under systemdrive\programdata\Microsoft\Windows\Hyper-V\

function MkSymLink
{
    Param($HardFile, $LinkLocation)
    Write-Host ""
    Write-Host "---------------Creating Symbolic Link for $HardFile"
    Write-Host ""
    $LinkFile = (get-item $HardFile).name
    #Write-Host "%systemdrive%\programdata\Microsoft\Windows\Hyper-V\$LinkLocation\$LinkFile" $HardFile
    cmd /c mklink "%systemdrive%\programdata\Microsoft\Windows\Hyper-V\$LinkLocation\$LinkFile" $HardFile
    Write-Host ""
    Write-Host "---------------Finished Symbolic Link for $HardFile"
}

#Get the VM config xml Fully Qualified Name and pass it to the MKSymLink function with the location for the for storing the Symbolic Link
$VMFileString = (get-item $VMConfigFile).name
MkSymLink -HardFile $VMConfigFile -LinkLocation "Virtual Machines"

#Call the SetACL function and pass it the FQN of the Symbolic Link to which we need to set the ACL
$ConfigFileSymLink = "$SystemDrive\programdata\Microsoft\Windows\Hyper-V\Virtual Machines\$VMFileString"
SetACL -ThisItem $ConfigFileSymLink

#Get the FQN of the boot VHD from the VM Config xml file passed into the script. Then pass this to the SetACL function
$VMVHDBootFile = $VMXML.configuration.'_83f8638b-8dca-4152-9eda-2ca8b33039b4_'.controller0.drive0.pathname."#text"
SetACL -ThisItem $VMVHDBootFile

#Build a string that defines the VM Service Account and use it with the cmd line utility icacls to set the permissions for all folders and files of the VM
Write-Host ""
Write-Host "---------------Setting Permissions for Folder $VMFolderName"
Write-Host ""
$VMSvcAccountFQN = 'NT VIRTUAL MACHINE\'+$VMSvcAccount
cmd /c icacls ""$VMFolderName"" /T /grant ""$VMSvcAccountFQN""':(F)'
Write-Host ""
Write-Host "---------------Finished Permissions for Folder $VMFolderName"

#Discover if there are any Snapshots. If so, for each one, create a Symbolic link for each by passing the FQN of the snapshot and snapsot link location
#Also, call SetACL to set permissions for the VM Services account on the Symbolic Link
foreach ($Thing in (Get-ChildItem $VMFolderName))
{
    If ($Thing.name -eq "Snapshots")
    {
    $SnapshotsFolder = $Thing.Fullname
        foreach ($Thing2 in (Get-ChildItem $SnapshotsFolder))
        {       
            If ($Thing2.extension -eq ".xml")
            {
            $VMSnapshotFileString = $Thing2.name
            MkSymLink -HardFile $Thing2.fullname -LinkLocation "Snapshots"
            $SnapshotFileSymLink = "$SystemDrive\programdata\Microsoft\Windows\Hyper-V\Snapshots\$VMSnapshotFileString"
            SetACL -ThisItem $SnapshotFileSymLink
            }
        }
    }
}
Write-Host ""
Write-Host "----------------End Script Recover-VM.ps1"

Recover-VM.ps1.txt

The File Replication Service has detected that the replica root path has changed from "x:\windows\sysvol\domain" to "x:\windows\sysvol\domain". If this is an intentional move then a file with the name NTFRS_CMD_FILE_MOVE_ROOT needs to be created under the new root path. This was detected for the following replica set: "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"

Changing the replica root path is a two step process which is triggered by the creation of the NTFRS_CMD_FILE_MOVE_ROOT file. [1] At the first poll which will occur in 5 minutes this computer will be deleted from the replica set. [2] At the poll following the deletion this computer will be re-added to the replica set with the new root path. This re-addition will trigger a full tree sync for the replica set. At the end of the sync all the files will be at the new location. The files may or may not be deleted from the old location depending on whether they are needed or not.

Indeed the description is also discussed in this KB article https://support.microsoft.com/kb/887440 and it would appear that the disk signatures for the volumes that host the SYSVOL folder structure are changed during the conversion of the system from physical to virtual. Following the procedures detailed in the error event and in the article did in fact remedy the situation and the NTFRS event logs showed this fact by logging 13560, 13553 and 13516 (which effectively proves the DC is functioning correctly from and FRS\SYSVOL perspective) over a period of time.

This issue has also been seen during the Restore of a Domain Controller from backup or during a failed attempt to move SYSVOL to another volume as per this article https://support.microsoft.com/kb/842162

I was asked why we recommend not using backups older than the lesser of TSL and Deleted Lifetime and below is my interpretation of the answer I got from a reputable source.

There are 2 main reasons we advise not using backups longer than the lesser of Deleted Lifetime and Tombstone Lifetime.

The first reason is very much the same as it has always been. We don’t want the possibility of introducing Lingering Objects. Basically, if you do a restore older than TSL this will introduce what the replication engine perceives as Lingering Objects and Strict Replication Consistency will kick in and stop Replication. Although the objects should disappear and not cause an issue in most circumstances, you still have replication failed and will have to use non recommended methods of getting it going again (i.e. “Allow Replication with Divergent or Corrupt Partner” registry Hack).

The second reason is more to do with the way group memberships are stored in the Link Table for Deleted objects in Windows 2008 R2 with the Recycle Bin feature enabled. Basically, when an object is removed from a group, the Link table (in the database) is updated with a flag and date stamp marking the object that has been removed as “De-activated”. When an object is deleted the groups to which it was a member retain the object as a member, but another flag “Deleted” is added with the time stamp. Both the “Deleted” and “De-activated” flags effectively make the objects not visible as members of the group. In other words the Link table still has some knowledge that an object was a member of a group (remember, group membership is stored by the group not the object that is a member of a group). This enables the ability to ensure that when an object is undeleted it gets added back to any groups it used to be a member of. The “De-activated” and “Deleted” flag is removed from the Link Table after Deleted Lifetime (i.e. as an object becomes a Recycled object; Tombstoned in previous versions). If a backup older than Deleted Lifetime is used then we will not get group membership back of objects as expected (at best), at worst we could have inconsistent link tables across DC’s (although this is a slim chance and needs certain circumstances to occur. Of which I am not sure if I totally understand).

Firstly you need to get the correct symbols files for the kernel memory dump, and just downloading the ones from WHDC or MSDN for the OS version and Service Pack version is not quite good enough, because the symbols change for each version of the kernel files that are released. There may be kernel files that have changed with Updates since the Service Pack was released.

1.    Install the Windows Debugging Tools https://www.microsoft.com/whdc/DevTools/Debugging/default.mspx on the computer from which you require a kernel memory dump.

2.   Download LiveKd from https://www.microsoft.com/technet/sysinternals/SystemInformation/LiveKd.mspx and on the computer that you require a Kernel Memory Dump from, uncompress it to the location that the Windows Debug Tools have been installed to (the default is "C:\Program Files\Debugging Tools for Windows (X86)\").

3.    Copy ntoskrnl.exe, ntkrnlpa.exe, kernel32.dll and ntdll.dll files (not sure if all of these are required every time, but I do it just in case) from the System32 folder of the computer to be debugged (without internet access) and copy them to a folder (e.g. c:\debugsymbols\system32) on a computer with internet access. (If the internet facing computer has the same versions of these files to the non internet facing then there is no need for this part, but the Symbol cache will be enormous and all we want is the symbol files for the kernel).

4.    Install the Debugging tools on the internet facing system (or copy the installed folder from the server you installed them on previously; the default is “C:\Program Files\Debugging Tools for Windows”).

5.    From a command prompt on the Internet facing server, run this command:

C:\<path to debugging tools>\Symchk.exe   /if <path to copied file>\*.*   /s srv*<path to folder to store symbols locally>*https://msdl.microsoft.com/download/symbols

e.g. C:\Program Files\Debugging Tools for Windows (x86)>Symchk.exe /if c:\debugsymbols\system32\*.* /s srv*c:\debugsymbols*https://msdl.microsoft.com/download/symbols

6.   Copy the cached symbols (i.e. the c:\debugsymbols folder and its new contents, minus the \system32 folder with the 4 exe\dll’s in it) from the internet facing server to the original server.

7.   On the computer that you require a Kernel Memory Dump from, Open WinDbg, click on the  "File" menu, and choose "Symbol Search Path". Enter the following path SRV*c:\debugsymbols* and click Ok. Close Windbg.exe.

8.    With Administrator privileges, open a Command prompt and navigate to the WinDbg installation folder (e.g. C:\Program Files\Debugging Tools for Windows (X86)\) if this is where you expanded LiveKd to and run livekd.exe.

9.    Type “.dump  -f c:\memory.dmp” (without the quotes) to generate the Complete Memory Dump on the C: drive (you will need to make sure there is enough space on this drive).

10.  Type q to quit LiveKD.

11.  You should find memory.dmp in the root of c:\

Your work is now complete and you can compress and deliver the kernel dump for analysis.