Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
Is it safe to delete “Account Unknown” entries from Windows ACLs in a domain environment?

I recently noticed that all of the objects in my Active Directory have two strange listings under the "Security" tab:

Account Unknown (S-1-5-21-#########-#########-#########-1835)
Account Unknown (S-1-5-21-#########-#########-#########-1835)

These entries are inherited from the root of Active Directory (DC=contoso,DC=local). They've been there for at least a few months, but maybe even years. I thought it might have something to do with a previous admin before my time, but then I noticed something even stranger:

When looking at the advanced security settings, there are actually dozens of entries with the names mentioned, but there aren't actually any permissions granted in these entries. It's just a big pile of entries (30+) that seemingly do nothing at all. (With the exception of a single entry that grants "Create msExchDynamicDistributionLi..."). We don't currently run an Exchange Server, although there was an Exchange Server on the domain a few months back as a pilot project, and probably will be again in the future.

So, I have a few questions.

  1. Would it be safe for me to delete these entries at the root? I doubt that anything critical would show up like this.

  2. Is there a proper way to reset the correct permissions at the root? In the advanced security settings I see a button called "Restore defaults". I'm a little bit hesitant to press it, but it sounds like what I want.

  3. Can somebody recommend a tool for auditing the ACLs of my Active Directory? If I've missed these for this long, I'm probably missing something else too.

share|improve this question
add comment

marked as duplicate by splattne Jun 4 '10 at 8:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.