Windows BackupRead / BackupWrite 和 ACL
我一直在尝试了解使用 BackupRead 和 BackupWrite 在计算机上备份数据的正确方法，尤其是可靠地恢复数据。
现在我明白了如何使用API并且已经成功了。然而，有一件事困扰着我。 除了文件内容本身之外，您还可以备份任何备用数据流以及安全信息 (ACL)。
现在，如果我要存储 ACL 数据进行备份，然后，一旦需要在另一台计算机或新设置的计算机上恢复数据，我应该如何处理与 ACL 相关的 SID？ SID 很可能对机器不再有效，应该如何选择正确的用户？ 现在我正在更大的范围内看待这个问题，假设这是一台具有多个用户和数百或数千个具有不同设置的对象的计算机，如果再次应用安全设置来恢复数据，将会很混乱。
如果软件的用户希望备份安全设置，那么用户必须采取哪些措施并相应地更新它们，或者什么？
另外，BackupRead 和 BackupWrite 将为我提供这些项目的原始二进制数据，这些数据并不是很难使用，但显然这个 API 甚至不打算面对这个问题。
任何人都知道备份应用程序应如何处理这种情况？您的想法是什么，或者对这个特定主题的指导方针有什么建议吗？
多谢。
I have been trying to understand what should be the right way in using BackupRead and BackupWrite for backing up data on a computer and especially about restoring it reliably.
Now I understand how to use the API and have been successful. However there's one thing that bothers me.
You can backup, beside the file content itself, any alternate data streams also the security information (ACLs).
Now if I would store the ACL data for backup and then later, once the data needs to be restored on a different machine OR a newly setup machine what should I do with the SIDs which are related to the ACL?
The SID is most likely no longer valid for the machine and how should the right user be selected?
Now I am looking at this on a bigger scale let's say this is a computer with multiple users and hundreds or thousands of objects with different settings this would be mess to get the data restored with the security settings applied to them again.
Is this something, if the user of the software wishes to backup the security settings, what the user has to take about himself and update them accordingly or what?
Additionally BackupRead and BackupWrite will give me the raw binary data of those items which is not all too hard to use however obviously this API does not even intend to face this issue.
Anyone has an idea how a backup application should handle this situation? What is your thought, or any pointers on guidelines for this specific topic?
Thanks a lot.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为您正确地理解了数据备份和恢复的问题。我认为正确认识问题就解决了问题的一半。我想您和 stackoverflow 网站的大多数用户一样，大多是软件开发人员，而不是大型网络的管理员。因此，您可以从软件开发人员的另一面而不是管理员的角度来看待问题。管理员了解 ACL 备份和恢复的限制并且已经使用它。
一般来说，您应该了解备份的主要目的是保存数据并稍后在同一台计算机或服务器上恢复数据。另一种标准情况是：更换硬件后从一台服务器恢复备份到另一台服务器。在这种情况下，旧服务器将不再存在。大多数情况下，人们会备份服务器并组织在客户端上工作，这样客户端计算机上不会保存任何重要数据。
在大多数情况下，备份的数据具有域组 SID、域用户 SID、众所周知的 SID或安全描述符中
BUILTIN域中的 SID 别名。在这种情况下，根本不需要更改 SID。如果管理员确实要对 ACL 进行一些更改，他可以使用不同的现有实用程序，例如 SubInACL.exe。如果您编写了要用于移动数据的备份/恢复软件以及安全信息，您可以在备份中包含一些有关保存的安全性中使用的帐户/组的本地 SID 的附加元信息描述符。在恢复软件中，您可以提供从保存的安全描述符中替换 SID 的可能性。许多年前，我为一位大客户编写了一些实用程序，用于在域迁移后清除文件系统、注册表和服务中 SD 中的 SID。事情并没有那么复杂。因此，我建议您可以在备份/恢复软件中实现相同的功能。
I think you understand correctly the problems with backup and restore of data. I think that correct understanding of problems is a half of its solving. I suppose that you are, like the most of users of the stackoverflow site, mostly software developer and not an administrator of a large network. So you see on the problem from another side of software developer and not from the side of the administrator. An administrator knows the restrictions of backup and restore of ACLs and already use it.
In general you should understand that the main purpose of backups to save the data and to restore the data later on the same computer or server. Another standard case is: one restore backup from one server to another server after the changing of hardware. In the case the old server will no more exist. Mostly one makes backups of servers and organize to work on the clients so, that no important data will be saved of the client computer.
In the most cases the backed up data has Domain Groups SIDs, Domain Users SIDs, well-known SIDs or SID aliases from the
BUILTINdomain in the security descriptors. In the case one need make no changes of SIDs at all. If the administrator do will make some changes in ACL he can use different existing utilities like SubInACL.exe.If you write Backup/Restore software which you want use for moving the data with the security information you can include in the backup some additional meta-information about the local SIDs of accounts/groups used in the saved security descriptors. In the Restore software you can provide the possibilities to replace SIDs from the saved security descriptors. Many year ago I wrote for one large customer some utilities to clear up the SIDs in SD in the file system, registry and services after domain migration. It was not so complex. So I suggest that you could implement the same feature in you Backup/restore software.
我确实相信 Backup* API 主要用于在同一台计算机上进行备份和恢复，这将使 SID 问题变得无关紧要。但是，假设您需要在新安装上恢复备份，以下是我对解决方案的想法。
对于众所周知的 SID（如Everyone、Creator Owner 等）来说，实际上没有任何问题。
对于依赖于域的 SID，您可以按原样存储它们，并且在恢复时您可以根据需要修复域部分。您可能还应该存储此类 SID 的域名。
对于本地用户和组，您至少应该存储每个 SID 的用户/组名称。恢复修复可以根据这些名称部分自动进行，也可以手动进行（假设应用程序的用户界面），您询问用户是否希望将此用户映射到新的本地用户，将这些 SID 转换为众所周知的 SID ，或保持原样。
与此类 SID 相关的大多数问题都可以（并且可能通常会）自动处理。我当然希望有一个足够智能的备份应用程序来完成我要求的恢复，并找出旧机器上的“Erik”在新机器上也一定是“Erik”。
附带说明一下，如果您确实决定采用这样的解决方案，请记住，为了返回到弹出窗口上 5% 完成的阻塞而启动过夜数据传输是多么烦人，它也可以轻松推迟:)
I do believe the Backup* APIs are primarily intended to backup and restore on the same machine, which would render the SID problem irrelevant. However, assuming a scenario where you need to restore a backup on a new install, here's my thoughts on solutions.
For well-known SIDs such as Everyone, Creator Owner and so on, there isn't really any problem.
For domain dependent SIDs you can store them as is, and upon restore you could fixup the domain part, if needed. Likely you should store the domain name as well for such SIDs.
For local users and groups, you should at least store the user/group name for each SID. Fixup on restore could be partially automatic based on these names, or manual (assuming an user interface for the application) where you ask the user whether he wishes to map this user to a new local user, convert these SIDs to a well-known SID, or keep as is.
Most of the issues related to such SIDs can (and probably typically will) be possible to handle automatically. I'd certainly appreciate a backup application that was smart enough to do the restore I asked it to and figure out that "Erik" on the old machine must be "Erik" on the new machine as well.
And a side note, if you do decide to go with such a solution, remember how annoying it is to start an overnight data transfer just to get back to something 5% done blocking on a popup it could just as easily defer :)