-
제목
Resources processing functionality by vmover.exe -
설명
What vmover.exe doing exactly with files/folders when it's processing them? RUM and CCU are both calling vmover to do that. -
해결 방안
vmover.exe is mainly performing several operations, depending on vmover.ini file header flags.
For example: Clone=Yes means that resource will be dual-ACL'ed. Dual-ACL basically means that vmover will apply target domain SID in NTFS permissions if source domain SID was found in those permissions. Also, source SID will no be removed.
If Clone was set to no, then source domain SID will be replaced with target domain SID.Another example: Undo=Yes will make vmover to perform a "Revert" operation, restoring source domain SIDs and removing target one from permissions.
So when vmover is processing files/folder/registry/etc, the following will happen:
- vmover reads the list of SIDs in resource ACLs
- vmover compares those SID with calculated value, combined from domain SID (in the beginning of each domain section, starting with []) and with user/group RID, calculated using math formula for source domain SIDs. Target domain RIDs are specified directly in vmover.ini file.
- if there's a match, vmover will apply target domain SID+user/group RID into resource ACLs.
- if resource ownership matches the source domainSID+RID, it'll be replaced with the target one
- also, if Profiles=Yes, then user's profile SID in registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList will also be replaced with the target domain SID+user RID
Note: it doesn't matter what is the name, UPN or any other resolved value is shown in permissions. For vmover to work with the said resource, only SID will be used. vmover also doesn't validate if the target domain SID is proper or not. Once the source value matches, target domain SID+RID will be applied.