How to clean up orphaned SID's in ACEs in AD?

Posted by geoffc on Server Fault See other posts from Server Fault or by geoffc
Published on 2010-11-04T12:50:22Z Indexed on 2011/01/12 19:55 UTC
Read the original article Hit count: 161

Filed under:

active-directory

|

tombstones

As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question.

Since I am informed in the answers there that a deleted object's SID (Group or User, so assigning rights to group only minimizes the issue, and does not fix it) will remain within ACEs they have been assigned, leaving them orphaned.

Lotus Domino, which has similar issues with back references, has an adminp process to clean up such orphaned references.

Is there a similar process in AD that would allow you to clean up such orphaned SIDs floating around your domain?

© Server Fault or respective owner

Related posts about active-directory

Can't join OS X Mavericks to AD Domain

as seen on Server Fault - Search for 'Server Fault'
I'm attempting to join an OS X Mavericks (10.9) client to a Windows Server 2008 Active Directory domain, however the bind fails with this error in the OS X client's system.log: Oct 24 15:03:15 host.domain.com com.apple.preferences.users.remoteservice[5547]: -[ODCAddServerSheetController handleOtherActionError:… >>> More
Retrieve user details from Active Directory using SID

as seen on Server Fault - Search for 'Server Fault'
Hi, How can I find a user in my AD when I have his/her SID. I don't want to rely on other attributes, since I am trying to detect changes to these. Example: I get a message about a change to user record containing: Message: User Account Changed: Target Account Name: test12 Target… >>> More
Retrieve user details from Active Directory using GUID

as seen on Server Fault - Search for 'Server Fault'
Hi, How can I find a user in my AD when I have his/her GUID. I don't want to rely on other attributes, since I am trying to detect changes to these. >>> More
Retrieve user details from Active Directory using GUID [closed]

as seen on Super User - Search for 'Super User'
Hi, How can I find a user in my AD when I have his/her GUID. I don't want to rely on other attributes, since I am trying to detect changes to these. >>> More
Office365 DirSync Active Directory Integration

as seen on Server Fault - Search for 'Server Fault'
I am preparing to deploy Office365 for my organization. We have an on premise Active Directory Domain Controller (Windows Server 2012 R2). We would like to leverage our Active Directory for: automatic user provisioning in Office365, and password synchronization, using the DirSync tool. Our Active… >>> More

Related posts about tombstones

Is it possible to find deleted objects in active directory without the assistance of a DLP software?

as seen on Server Fault - Search for 'Server Fault'
It seems like a large number of security groups have been deleted from the organization's AD. i was able to find the tombstones but i see there 1400 objects from the last 180 days and i know for certain that the important groups which have been deleted, have been deleted somewhere between yesterday's… >>> More
How to clean up orphaned SID's in ACEs in AD?

as seen on Server Fault - Search for 'Server Fault'
As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question. Since I am informed in the answers there that a deleted object's SID (Group or User, so assigning rights to group only minimizes the issue, and does not fix it) will remain within… >>> More
Code Structure / Level Design: Plants vs Zombies game level dissection

as seen on Game Development - Search for 'Game Development'
Hi Friends, I am interested in learning the class structure of Plants vs Zombies, particularly level design; for those who haven't played it - this video contains nice play-through: http://www.youtube.com/watch?v=89DfdOIJ4xw. How would I go ahead and design the code, mostly structure & classes… >>> More
InputDispatcher Error

as seen on Stack Overflow - Search for 'Stack Overflow'
INFO/ActivityManager(68): Process com.example (pid 390) has died. ERROR/InputDispatcher(68): channel '406ed580 com.example/com.example.afeTest (server)' ~ Consumer closed input channel or an error occurred. events=0x8 ERROR/InputDispatcher(68): channel '406ed580 com.example/com.example.afeTest (server)'… >>> More
phonegap.js crashes android app

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm having this weird problem, where including the phonegap.js file in my project causes the app to crash on both the android emulator and my phone. I got the latest file from GitHub, so I can't see why this isn't working. This happens even if I try to build the sample project that's included in… >>> More