Restore‑WindowsSecurityDescriptor

SYNOPSIS

Restores Windows security descriptors from a unified JSON backup.

SYNTAX

Restore-WindowsSecurityDescriptor [-BackupPath] <String> [-VerificationCertificate <X509Certificate2>]
 [-Server <String>] [-AllowedBaseDistinguishedName <String>] [-AllowedRootPath <String>]
 [-Credential <PSCredential>] [-TimeoutSeconds <Int32>] [-PassThru] 
 [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION

Parses a versioned backup as data, validates every record and SHA-256 digest, resolves every target, and only then restores the selected descriptor sections. Invalid later records fail before the first write. Schema version 2 additionally restores SMB share records on their originating computer and Active Directory records through one pinned writable domain controller inside an explicit allowed organizational unit, matched by immutable object GUID and domain partition. Task Scheduler records restore on their originating computer inside an explicit allowed root path. Certificate private-key records restore on their originating computer, relocate the key by provider, key name, and key scope, and pass through the same fail-closed write gates as every other private-key write.

EXAMPLES

EXAMPLE 1

Restore-WindowsSecurityDescriptor `
    -BackupPath C:\Backup\acl.json `
    -Confirm:$false

Verifies and restores every record in the unified backup.

PARAMETERS

-AllowedBaseDistinguishedName

The organizational unit that bounds every Active Directory restore. It is required when the backup contains Active Directory records.

Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-AllowedRootPath

The non-system task folder that bounds every Task Scheduler restore. It is required when the backup contains Task Scheduler records.

Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-BackupPath

The literal path to a unified backup created by Backup-WindowsSecurityDescriptor.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Credential

An optional credential used only for the direct LDAP bind to Server.

Type: PSCredential
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-PassThru

Returns each restored security descriptor after persistence.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Server

The explicit DNS name of the writable domain controller used for every Active Directory record. When it is omitted, one writable domain controller is located in the current computer's domain and pinned.

Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-TimeoutSeconds

Sets the LDAP request timeout from 1 through 300 seconds.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: 10
Accept pipeline input: False
Accept wildcard characters: False

-VerificationCertificate

The RSA X.509 certificate required to verify every signed record.

Type: X509Certificate2
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

None

OUTPUTS

None

WindowsAccessControl.SecurityDescriptor

NOTES

RELATED LINKS