How to retrieve unconverted data from xml file - powershell

Question

We have a script that does a backup of NTFS permissions to an .xml file:
Get-Acl -Path 'C:\myFolder' | Export-Clixml -Path $ntfsXmlFile
Then on another machine we try to restore these permissions on a specific folder. This would be easy by doing
Import-Clixml -LiteralPath $ntfsXmlFile | Set-Acl -Path 'C:\otherFolder'
However, in some cases it can be that not all accounts in the $ntfsXmlFile are available on the second machine. So we create the Access Control List manually and verify if each Access Control Entry exists before adding it to the ACL.
The problem is that unknown account names are converted to an unrecognizable string when using Import-Clixml:
BinaryLength AccountDomainSid Value
------------ ---------------- -----
28 S-1-5-21-497061539-31097515 S-1-5-21-497061539-31067-310415-1030
The xml file exported by Export-Clixml looks like this:
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
<Obj RefId="0">
<TN RefId="0">
<T>System.Security.AccessControl.DirectorySecurity</T>
<T>System.Security.AccessControl.FileSystemSecurity</T>
<T>System.Security.AccessControl.NativeObjectSecurity</T>
<T>System.Security.AccessControl.CommonObjectSecurity</T>
<T>System.Security.AccessControl.ObjectSecurity</T>
<T>System.Object</T>
</TN>
<ToString>System.Security.AccessControl.DirectorySecurity</ToString>
<Props>
<S N="AccessRightType">System.Security.AccessControl.FileSystemRights</S>
<S N="AccessRuleType">System.Security.AccessControl.FileSystemAccessRule</S>
<S N="AuditRuleType">System.Security.AccessControl.FileSystemAuditRule</S>
<B N="AreAccessRulesProtected">true</B>
<B N="AreAuditRulesProtected">false</B>
<B N="AreAccessRulesCanonical">true</B>
<B N="AreAuditRulesCanonical">true</B>
</Props>
<MS>
<S N="PSPath">Microsoft.PowerShell.Core\FileSystem::C:\myFolder</S>
<S N="PSParentPath">Microsoft.PowerShell.Core\FileSystem::C:\myFolder</S>
<S N="PSChildName">B</S>
<Obj N="PSDrive" RefId="1">
<TN RefId="1">
<T>System.Management.Automation.PSDriveInfo</T>
<T>System.Object</T>
</TN>
<ToString>C</ToString>
<Props>
<S N="CurrentLocation"></S>
<S N="Name">C</S>
<Obj N="Provider" RefId="2">
<S>Microsoft.PowerShell.Core\FileSystem</S>
</Obj>
<S N="Root">C:\</S>
<S N="Description">System</S>
<Nil N="MaximumSize" />
<Obj N="Credential" RefId="3">
<TN RefId="2">
<T>System.Management.Automation.PSCredential</T>
<T>System.Object</T>
</TN>
<ToString>System.Management.Automation.PSCredential</ToString>
<Props>
<Nil N="UserName" />
<Nil N="Password" />
</Props>
</Obj>
<Nil N="DisplayRoot" />
</Props>
<MS>
<U64 N="Used">70907654144</U64>
<U64 N="Free">14884746544</U64>
</MS>
</Obj>
<Obj N="PSProvider" RefId="4">
<TN RefId="3">
<T>System.Management.Automation.ProviderInfo</T>
<T>System.Object</T>
</TN>
<ToString>Microsoft.PowerShell.Core\FileSystem</ToString>
<Props>
<S N="ImplementingType">Microsoft.PowerShell.Commands.FileSystemProvider</S>
<S N="HelpFile">System.Management.Automation.dll-Help.xml</S>
<S N="Name">FileSystem</S>
<S N="PSSnapIn">Microsoft.PowerShell.Core</S>
<S N="ModuleName">Microsoft.PowerShell.Core</S>
<Nil N="Module" />
<S N="Description"></S>
<S N="Capabilities">Filter, ShouldProcess, Credentials</S>
<S N="Home">C:\Users\bob</S>
<Obj N="Drives" RefId="5">
<TN RefId="4">
<T>System.Collections.ObjectModel.Collection`1[[System.Management.Automation.PSDriveInfo, System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]]</T>
<T>System.Object</T>
</TN>
<LST>
<S>A</S>
<Ref RefId="1" />
<S>D</S>
<Obj RefId="6">
<S>L</S>
</Obj>
<S>S</S>
<Obj RefId="7">
<S>T</S>
</Obj>
<S>TestDrive</S>
<S>Z</S>
</LST>
</Obj>
</Props>
</Obj>
<Nil N="CentralAccessPolicyId" />
<Nil N="CentralAccessPolicyName" />
<S N="Path">Microsoft.PowerShell.Core\FileSystem::C:\myFolder</S>
<S N="Owner">BUILTIN\Administrators</S>
<S N="Group">GROUPHC\Domain Users</S>
<Obj N="Access" RefId="8">
<TN RefId="5">
<T>System.Security.AccessControl.AuthorizationRuleCollection</T>
<T>System.Collections.ReadOnlyCollectionBase</T>
<T>System.Object</T>
</TN>
<IE>
<S>System.Security.AccessControl.FileSystemAccessRule</S>
<S>System.Security.AccessControl.FileSystemAccessRule</S>
<S>System.Security.AccessControl.FileSystemAccessRule</S>
</IE>
</Obj>
<S N="Sddl">O:BAG:DUD:PAI(A;OICI;FA;;;BA)(A;OICI;0x1301bf;;;S-1-5-21-497061539-3109733767-3104415515-1037)(A;OICI;0x1301bf;;;S-1-5-21-497061539-3109733767-3104415515-1038)</S>
<S N="AccessToString">BUILTIN\Administrators Allow FullControl_x000A_PC1\TestUser1 Allow Modify, Synchronize_x000A_PC1\TestUser2 Allow Modify, Synchronize</S>
<S N="AuditToString"></S>
</MS>
</Obj>
</Objs>
We're trying to access the property Access but the following fails:
$rawXml = [Xml] (Get-Content -LiteralPath $ntfsFile)
$rawXml.SelectNodes('Objs.Obj.MS.Obj.N.Access')
Ideally we would like to retrieve the following:
BUILTIN\Administrators Allow FullControl_x000A_
PC1\TestUser1 Allow Modify, Synchronize_x000A_
PC1\TestUser2 Allow Modify, Synchronize
Is there a way to get the correct account principal name out of the exported xml file?

Answer 1

Thanks to #Mathias in the comments the following code works to retrieve the Access list:
$rawXml = [Xml] (Get-Content -Path $ntfsFile)
($rawXml.Objs.Obj.MS.S | Where-Object N -EQ AccessToString |
ForEach-Object InnerText ) -split '_x000A_'