10

As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question.

Since I am informed in the answers there that a deleted object's SID (Group or User, so assigning rights to group only minimizes the issue, and does not fix it) will remain within ACEs they have been assigned, leaving them orphaned.

Lotus Domino, which has similar issues with back references, has an adminp process to clean up such orphaned references.

Is there a similar process in AD that would allow you to clean up such orphaned SIDs floating around your domain?

2
  • 2
    I do not know an automagic way to do this, hence a comment instead of answer. I suspect this is a roll-your-own solution and I am also interested in responses. The Microsoft utility dsacls can be used to manage domain ACLs, which I think could be useful in this scenario... Possibly in tandem with some PowerShell-fu.
    – jscott
    Nov 4, 2010 at 13:17
  • 1
    Odd, this must be a common problem, or else no one really cares about orphaned SID's...
    – geoffc
    Nov 4, 2010 at 15:18

4 Answers 4

8

I haven't tested this so forgive my preemptive post (but I don't have a test domain and don't plan on testing this in production) but perhaps you're looking for SUBINACL. Download it here

subinacl.exe /help /cleandeletedsidsfrom provides the following:

/cleandeletedsidsfrom=domain[=dacl|sacl|owner|primarygroup|all]

delete all ACEs containing deleted (no valid) Sids from DomainName
You can specify which part of the security descriptor will be scanned
(default=all)
If the owner is deleted, new owner will be the Administrators group.
If the primary group is deleted, new primary group will be the Users group.

Appears you can use this with /samobject switch to apply to Users or Groups.

1

how about just using a tool like Security Explorer? It's like Windows Explorer on steroids, and can centrally locate and delete Orphaned SIDs to clean them up. www.securityexplorer.com.

1
  • Security Explorer, $445.00 for 30 days usage. No Thanks Dell. Apr 3, 2014 at 14:56
0

It's one aspect of the tool, but DatAdvantage does this and a bunch of other systemic file/directory management and cleanup.

-1

i recently ran across this issue when working with a client and instead of going through all the powershell and other stuff that i was having issues with i wrote a quick program with a GUI to remove all the ghost accounts. this is much simpler. Please check it out at http://chstechsolutions.com/articles/2017/3/1/j8knqicyixvon3byelairoub47mvv6

I think it is much simpler and it is free.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .