Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking into some weird issues with active directory and group policy. This domain has been upgraded from windows NT and has had a few different administrators over the years. I am looking through the Default Domain group policy and Default Domain Controller group policy. In the security areas, using the log on locally area as an example, it shows SIDes that begin with asterisks and are quite long they look sort of like the following


Normally, when I see something like this I would think that the User account was no longer there and this was never cleaned up. Am I wrong in my assumption? Thanks in advance

share|improve this question
up vote 6 down vote accepted

Yes, you are correct, SIDs that are shown in numeric form typically mean that they cannot be resolved by either your local machine or your domain controller.

Download SysInternals' (Microsoft's) PSGetSID tool (here) and obtain the SID for your domain:

psgetsid.exe <DOMAIN_NAME>

Have a look at the format of a SID on wikipedia, to see if the domain part of your unresolved SID matches your domain's SID.

share|improve this answer
I will take a look at that tomorrow. thanks – Phillip R. Aug 30 '12 at 22:30
Thanks for pointing me at the utility, I had used it once but it has been awhile for the need of it. So, it had completely slipped my mind. – Phillip R. Aug 31 '12 at 12:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.