Abfrage lokaler Gruppenmitgliedschaften in Windows - Bug umschiffen

<#
    DOMAIN REJOIN GROUP MEMBER LEFTOVER FIX
    !! only use this script version if you want to remove 'a user specific SID' from the SAM entry  otherwise use the second script on this page !!  
#>

# SID to exclude
$exclude = 'S-1-5-21-3436018609-1888576025-3894982363-1008'  

# ====================================

# check elevation
$myWindowsID=[System.Security.Principal.WindowsIdentity]::GetCurrent()
$myWindowsPrincipal=new-object System.Security.Principal.WindowsPrincipal($myWindowsID)
$adminRole=[System.Security.Principal.WindowsBuiltInRole]::Administrator
if (!$myWindowsPrincipal.IsInRole($adminRole)){
    # elevate
    start-process "powershell" -Verb "runas" -ArgumentList "-File",$MyInvocation.MyCommand.Definition  
    exit
}

# elevated area ------

# Gain permission to SAM
# privilege token adjustment
$nttools = Add-Type -Member '[DllImport("ntdll.dll")] public static extern int RtlAdjustPrivilege(ulong a, bool b, bool c, ref bool d);' -Name nttools -PassThru  
9,17,18 | %{$nttools::RtlAdjustPrivilege($_, 1, 0, [ref]0) | out-null}
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SAM\SAM", 'ReadWriteSubTree', 'ChangePermissions')  
$acl = $regkey.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule([System.Security.Principal.SecurityIdentifier]'S-1-5-32-544', 'FullControl',"ContainerInherit,ObjectInherit","None",'Allow')  
$acl.SetAccessRule($rule)
$regKey.SetAccessControl($acl)
$regKey.Close()

# get binary from SAM
[byte[]]$bytes = (Get-ItemProperty 'HKLM:\SAM\SAM\Domains\Builtin\Aliases\00000220' -Name C).C  
# offset position of sids
$os = [bitconverter]::ToUInt32($bytes[40..43],0) + 52
# length of sid area
$count = [bitconverter]::ToUInt32($bytes[44..47],0)
# extract sid area
[byte[]]$memberbytes = $bytes[$os..($os+$count)]

# filter out sid
[byte[]]$newmemberbytes = 0..(($memberbytes.Count / 28)-1)  | ?{(New-Object System.Security.Principal.SecurityIdentifier ([byte[]]$memberbytes[($_*28)..(($_*28)+27)]),0) -ne ([System.Security.Principal.SecurityIdentifier]$exclude) } | %{[byte[]]$memberbytes[($_*28)..(($_*28)+27)]}

# update members area length in header
[bitconverter]::GetBytes($newmemberbytes.count).CopyTo($bytes,44)

# update membercount in header
[bitconverter]::GetBytes(($newmemberbytes.count / 28)).CopyTo($bytes,48)

# write back data
Set-ItemProperty 'HKLM:\SAM\SAM\Domains\Builtin\Aliases\00000220' -Name C -Value ([byte[]]($bytes[0..($os-1)] + $newmemberbytes)) -Force | out-null  

# restore permissions
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SAM\SAM", 'ReadWriteSubTree', 'ChangePermissions')  
$acl = $regKey.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule([System.Security.Principal.SecurityIdentifier]'S-1-5-32-544','ReadPermissions,ChangePermissions','ContainerInherit,ObjectInherit','None','Allow')  
$acl.SetAccessRule($rule)
$regKey.SetAccessControl($acl)
$regKey.Close()

write-host "FIX done." -F Green  
read-host "Press enter to exit script."  

<#
    DOMAIN REJOIN GROUP MEMBER LEFTOVER FIX
    (removes all non resolvable SIDs)
#>

# check elevation
$myWindowsID=[System.Security.Principal.WindowsIdentity]::GetCurrent()
$myWindowsPrincipal=new-object System.Security.Principal.WindowsPrincipal($myWindowsID)
$adminRole=[System.Security.Principal.WindowsBuiltInRole]::Administrator
if (!$myWindowsPrincipal.IsInRole($adminRole)){
    # elevate
    start-process "powershell" -Verb "runas" -ArgumentList "-File",$MyInvocation.MyCommand.Definition  
    exit
}

# elevated area ------

# Gain permission to SAM
# privilege token adjustment
$nttools = Add-Type -Member '[DllImport("ntdll.dll")] public static extern int RtlAdjustPrivilege(ulong a, bool b, bool c, ref bool d);' -Name nttools -PassThru  
9,17,18 | %{$nttools::RtlAdjustPrivilege($_, 1, 0, [ref]0) | out-null}
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SAM\SAM", 'ReadWriteSubTree', 'ChangePermissions')  
$acl = $regkey.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule([System.Security.Principal.SecurityIdentifier]'S-1-5-32-544', 'FullControl',"ContainerInherit,ObjectInherit","None",'Allow')  
$acl.SetAccessRule($rule)
$regKey.SetAccessControl($acl)
$regKey.Close()

# get binary from SAM
[byte[]]$bytes = (Get-ItemProperty 'HKLM:\SAM\SAM\Domains\Builtin\Aliases\00000220' -Name c).c  
# offset position of sids
$os = [bitconverter]::ToUInt32($bytes[40..43],0) + 52
# length of sid area
$count = [bitconverter]::ToUInt32($bytes[44..47],0)
# extract sid area
[byte[]]$memberbytes = $bytes[$os..($os+$count)]

# filter out non resolvable sids
[byte[]]$newmemberbytes = 0..(($memberbytes.Count / 28)-1)  | ?{try{(New-Object System.Security.Principal.SecurityIdentifier ([byte[]]$memberbytes[($_*28)..(($_*28)+27)]),0).Translate([System.Security.Principal.NTAccount]);$true}catch{$false}} | %{[byte[]]$memberbytes[($_*28)..(($_*28)+27)]}

# update members area length in header
[bitconverter]::GetBytes($newmemberbytes.count).CopyTo($bytes,44)

# update membercount in header
[bitconverter]::GetBytes(($newmemberbytes.count / 28)).CopyTo($bytes,48)

# write back data
Set-ItemProperty 'HKLM:\SAM\SAM\Domains\Builtin\Aliases\00000220' -Name C -Value ([byte[]]($bytes[0..($os-1)] + $newmemberbytes)) -Force | out-null  

# restore permissions
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SAM\SAM", 'ReadWriteSubTree', 'ChangePermissions')  
$acl = $regKey.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule([System.Security.Principal.SecurityIdentifier]'S-1-5-32-544','ReadPermissions,ChangePermissions','ContainerInherit,ObjectInherit','None','Allow')  
$acl.SetAccessRule($rule)
$regKey.SetAccessControl($acl)
$regKey.Close()

write-host "FIX done." -F Green  
read-host "`nPress enter to exit script"  

New-Object System.Security.Principal.SecurityIdentifier ([byte[]]([regex]::matches('010500000000000515000000b17bcdcc19629170dbb628e8f0030000','..').Value | %{[System.Convert]::ToUInt32($_,16)})),0  

BinaryLength AccountDomainSid                          Value                                         
------------ ----------------                          -----                                         
          28 S-1-5-21-3436018609-1888576025-3894982363 S-1-5-21-3436018609-1888576025-3894982363-1008