Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question.

Since I am informed in the answers there that a deleted object's SID (Group or User, so assigning rights to group only minimizes the issue, and does not fix it) will remain within ACEs they have been assigned, leaving them orphaned.

Lotus Domino, which has similar issues with back references, has an adminp process to clean up such orphaned references.

Is there a similar process in AD that would allow you to clean up such orphaned SIDs floating around your domain?

share|improve this question
I do not know an automagic way to do this, hence a comment instead of answer. I suspect this is a roll-your-own solution and I am also interested in responses. The Microsoft utility dsacls can be used to manage domain ACLs, which I think could be useful in this scenario... Possibly in tandem with some PowerShell-fu. – jscott Nov 4 '10 at 13:17
Odd, this must be a common problem, or else no one really cares about orphaned SID's... – geoffc Nov 4 '10 at 15:18
up vote 6 down vote accepted

I haven't tested this so forgive my preemptive post (but I don't have a test domain and don't plan on testing this in production) but perhaps you're looking for SUBINACL. Download it here

subinacl.exe /help /cleandeletedsidsfrom provides the following:


delete all ACEs containing deleted (no valid) Sids from DomainName
You can specify which part of the security descriptor will be scanned
If the owner is deleted, new owner will be the Administrators group.
If the primary group is deleted, new primary group will be the Users group.

Appears you can use this with /samobject switch to apply to Users or Groups.

share|improve this answer

how about just using a tool like Security Explorer? It's like Windows Explorer on steroids, and can centrally locate and delete Orphaned SIDs to clean them up.

share|improve this answer
Security Explorer, $445.00 for 30 days usage. No Thanks Dell. – Gordon Bell Apr 3 '14 at 14:56

It's one aspect of the tool, but DatAdvantage does this and a bunch of other systemic file/directory management and cleanup.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.