Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's not uncommon to see entries in Windows ACLs (NTFS files/folders, registry, AD objects, etc.) with the name "Account Unknown (SID)". Obviously these are because of old AD users or groups which at some point had permissions manually configured on the relevant object and have since been deleted.

Does anyone know if it is safe to remove these "Account Unknown" ACEs?

My gut feeling is that it should be just fine, but I'm wondering if anyone has any past experiences where doing this has caused trouble?

Normally I just ignore these, but the company I'm working at now seems to have an abnormal number of these, most likely due to past admins' inexperience with AD/Windows and assigning permissions to user accounts rather than groups in all sorts of weird places.

FWIW, our environment is not complex, a single domain forest, 4 DCs in 3 sites, with all network connectivity and replication healthy, so I'm certain that these "Account Unknown" entries are really old accounts, and not just because of some failure to resolve the SID to a human-readable name.

share|improve this question
You shouldn't really have ACL entries for individual users in the first place, you should be setting them at group level in order to avoid this sort of problem and to keep things as simple as possible. – kaerast May 31 '10 at 14:32
I know that, but this cruft is a result of several people having a hand in AD administration in the past and none of them having any real concept of generally accepted best practices. – ThatGraemeGuy May 31 '10 at 15:36
There are so many things that would be different in an ideal world. Unfortunately, we don't live in that world. :( – John Gardeniers Jun 1 '10 at 4:37
up vote 8 down vote accepted

As long as you have no connectivity problems, yes, it's safe to delete them. Do be careful because Windows will show "Account Unknown" if it can't connect to AD, or if you have multiple domains it might take a few moments to cross the domain boundaries, etc.

share|improve this answer
As per the original question: "single domain forest, 4 DCs in 3 sites, with all network connectivity and replication healthy, so I'm certain that these "Account Unknown" entries are really old accounts" – ThatGraemeGuy May 31 '10 at 14:29
I know, but I wanted to throw that part in there as others in different situations will inevitably read this answer, without having ready anything more than the title of your question. – Chris S May 31 '10 at 14:44
I wish I could upvote it more. Explaining the "why" behind your answer is really important on serverfault where any "basic" information questions tend to get moved to superuser – Jim B May 31 '10 at 18:39

take a backup and go ahead.

Assuming you don't have any trusts with other domains, and as earlier pointed out, any network connectivity issues.

you can take backup of ACLs using xcacls.exe or icacls.exe (Vista and above) They can be in format such a way that, you can copy paste and reapply them back.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.