I can’t figure this one out, and it’s vague enough that I can’t determine the appropriate search terms to research it. Apologies if this is frequently asked!

On many servers on our domain, when I check the membership in the Administrators group, I often see what appears to be duplicate entries—one a domain login or group, and the other the same item followed by the SID. Example:

OURDOMAIN\WebLogin (S-1-5-21-2000478354-guid-etc-etc)

They don’t appear to impact performance or security, but they are confusing. What does this mean? How do they come about? Most importantly, is it safe to delete the redundant-looking one?

  • Question - was the account migrated from another domain? – dsolimano Mar 30 '17 at 22:16
  • Quite Possibly. I'd have to review, as I wasn't involved with this side of things back when that happened. If this is a possible explanation, please post it as an answer! – Philip Kelley Mar 30 '17 at 22:27

I can't find the documentation for this, but within our network, I only see this on computers/accounts that have been migrated from other domains with SID history. As long as the migration is complete, it should be safe to delete the old ones, but as the Technet blog gets into, it better be complete.

  • Accepting this as answer. Deleting the oddball duplicates has no impact on performance, and it is conceivable that something like this happened during a domain transition years back. – Philip Kelley Jun 13 '17 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.