File SDDL not equal although it should be - powershell

Question

We're trying to compare NTFS permissions for files or folders using the SDDL attribute. The only thing we're interested in is if the ACL is equal or not, by using the SDDL and not other methods like AccessToString or just comparing two plain ACL objects. This is because we had issues in the past with the standard way of doing this.
So, we now run against an issue where File1 and File2 have exactly the same permissions when checking the Advanced Permissions tab in Windows. However, the SDDL says it's not equal, although we take away the Owner O: part from the SDDL string as indicated here, as the owner doesn't interest us.
The code:
Function Test-ACLequal {
Param (
$Source,
$Target
)
$CompParams = #{
ReferenceObject = Get-Acl -LiteralPath $Source
PassThru = $True
}
$CompParams.DifferenceObject = Get-Acl -LiteralPath $Target
$AccessParams = #{
ReferenceObject = ($CompParams.ReferenceObject.sddl -split 'G:', 2 | Select -Last 1)
DifferenceObject = ($CompParams.DifferenceObject.sddl -split 'G:', 2 | Select -Last 1)
PassThru = $True
}
if (Compare-Object #AccessParams) {
Write-Verbose 'Test-ACLequalHC: Not equal'
$false
}
else {
Write-Verbose 'Test-ACLequalHC: Equal'
$True
}
}
Test-ACLequal -Source $File1-Target $File2
You can clearly see there is a difference between both files:
$AccessParams.ReferenceObject
DUD:(A;ID;FA;;;BA)(A;ID;0x1200a9;;;S-1-5-21-1078081533-261478967-839522115-243052)(A;ID;0x1301ff;;;S-1
-5-21-1078081533-261478967-839522115-280880)(A;ID;0x1301ff;;;S-1-5-21-1078081533-261478967-839522115-6
96733)(A;ID;0x1301ff;;;S-1-5-21-1078081533-261478967-839522115-696745)
$AccessParams.DifferenceObject
DUD:AI(A;ID;FA;;;BA)(A;ID;0x1200a9;;;S-1-5-21-1078081533-261478967-839522115-243052)(A;ID;0x1301ff;;;S
-1-5-21-1078081533-261478967-839522115-280880)(A;ID;0x1301ff;;;S-1-5-21-1078081533-261478967-839522115
-696733)(A;ID;0x1301ff;;;S-1-5-21-1078081533-261478967-839522115-696745)
Is there a way to compare files by using the SDDL without running into this issue?

Answer 1

Does using .Equals work for you here?
$sourceAcl = Get-Acl $source
$targetAcl = Get-Acl $target
if ($sourceAcl.sddl.Equals($targetAcl.sddl)) {
# Do something
....
}
This includes the owner however. In your example where you're removing it, you're also converting the object to a string, so using Compare-Object isn't really necessary. I'm also not sure how safe the split you're using is. You could also do:
$sourceAcl = Get-Acl $source
$targetAcl = Get-Acl $target
$s = $sourceAcl.sddl -replace "^O:[^:]+:",""
$t = $targetAcl.sddl -replace "^O:[^:]+:",""
if ($s -eq $t) {
# Do something
....
}