Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Lets say you have a user in AD. They get all sorts of rights granted over time. They also get access in a remote domain that trusts your domain, to resources.

Then they leave the company and you delete their object. The deleted object becomes a tombstone object, which is meant to preserve the SID in case you wish to 'undelete' them, sort of.

So what happens to the ACE's that had their SID in it? Within the domain, my guess is after the tombstone expires it will get cleaned up. Since after all, what is the point of preserving the SID if all references to it are already gone.

What happens to the ACE's in the remote trusting domain? How does it clear up orphaned SIDs in ACE's and whatnot?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

So what happens to the ACE's that had their SID in it?

Any ACL containing an ACE for a deleted user will display the orphaned SID instead of user name. This ACE will not be removed after the tombstone lifetime.

Within the domain, my guess is after the tombstone expires it will get cleaned up. Since after all, what is the point of preserving the SID if all references to it are already gone.

The ACE is, itself, and explicit reference to the SID. An orphaned SID's ACE will remain "forever" in the ACL unless removed.

What happens to the ACE's in the remote trusting domain? How does it clear up orphaned SIDs in ACE's and whatnot?

Same situation as above. There is no automatic "clean-up" of which I am aware.

This "problem" is one of the many reasons for granting permissions/delegations per group rather than per user for most everything. When the users leaves the company, you delete their user object. Granting their replacement the same permissions throughout the domain is as simple as adding the new hire into the existing group.

share|improve this answer
    
+1 for 'This is one of the reasons you never apply a user directly to an object's ACL' –  Chris Thorpe Nov 4 '10 at 12:04
    
@Chris: Never is such an absolute. While you generally never want to assign permissions on a user basis, there are cases when that's necessary. –  joeqwerty Nov 4 '10 at 12:28
    
@joeqwerty: Yes. Our most common exception, using per-user ACEs, is for user profile directories. –  jscott Nov 4 '10 at 12:35
    
Or My Documents redirection, or user home directories, etc., etc. ;) –  joeqwerty Nov 4 '10 at 12:42
1  
@geoffc You model your AD groups after your company's required roles/positions. You populate the groups with the user(s) which fulfill those roles. You should only need to delete the group when the role/position is eliminated. So it's a less frequent "problem". However ACLs are not self-cleaning regardless of the object type (user, group, computer, etc) in the ACE. –  jscott Nov 4 '10 at 12:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.