Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question.

Since I am informed in the answers there that a deleted object's SID (Group or User, so assigning rights to group only minimizes the issue, and does not fix it) will remain within ACEs they have been assigned, leaving them orphaned.

Lotus Domino, which has similar issues with back references, has an adminp process to clean up such orphaned references.

Is there a similar process in AD that would allow you to clean up such orphaned SIDs floating around your domain?

share|improve this question
1  
I do not know an automagic way to do this, hence a comment instead of answer. I suspect this is a roll-your-own solution and I am also interested in responses. The Microsoft utility dsacls can be used to manage domain ACLs, which I think could be useful in this scenario... Possibly in tandem with some PowerShell-fu. –  jscott Nov 4 '10 at 13:17
    
Odd, this must be a common problem, or else no one really cares about orphaned SID's... –  geoffc Nov 4 '10 at 15:18
add comment

2 Answers 2

up vote 3 down vote accepted

I haven't tested this so forgive my preemptive post (but I don't have a test domain and don't plan on testing this in production) but perhaps you're looking for SUBINACL. Download it here

subinacl.exe /help /cleandeletedsidsfrom provides the following:

/cleandeletedsidsfrom=domain[=dacl|sacl|owner|primarygroup|all]

delete all ACEs containing deleted (no valid) Sids from DomainName
You can specify which part of the security descriptor will be scanned
(default=all)
If the owner is deleted, new owner will be the Administrators group.
If the primary group is deleted, new primary group will be the Users group.

Appears you can use this with /samobject switch to apply to Users or Groups.

share|improve this answer
add comment

how about just using a tool like Security Explorer? It's like Windows Explorer on steroids, and can centrally locate and delete Orphaned SIDs to clean them up. www.securityexplorer.com.

share|improve this answer
    
Security Explorer, $445.00 for 30 days usage. No Thanks Dell. –  Gordon Bell Apr 3 at 14:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.