Answered by:
Ghost Unknown accounts

Question
-
If I right click on a folder on our server and go to permissions to view who has rights to the folder many of our folders have these “unknown accounts”. I wish I could put a picture in. They all do not have an icon of a user and just have a string instead of a account name. It appears all start with s-1-5-21- and then a long line of numbers.
I a fairly sure I know what it is. When a user leaves our company they are removed from the domain. Now that account still shows in the ntfs permissions but there is no name so it is just displaying the SID for the account that no longer exists.
Well I have been asked to clean up the server and remove these ghost accounts.
There must be a simple batch or vbs script that can do this or even a simple way through the GUI.
If it the way involves through a batch or VBS I would like to be able to see the changes fist if possible.
Thanks in advance.
Monday, August 24, 2009 8:04 PM
Answers
-
Subinacl.exe should do the job for you:
http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en
The action "cleanDeletedSIDsFrom" removes SIDs that cannot be resolved from files/folders.
The domain can be specified as parameter.
Sample:
subinacl /subdirectories c:\data\*.* /cleandeletedsidsfrom=MyDomain
Caution:
Depending on the amount of data this can be quite time and ressource consuming.
Patrick- Marked as answer by tnetplus Monday, August 24, 2009 11:11 PM
Monday, August 24, 2009 8:36 PM
All replies
-
Subinacl.exe should do the job for you:
http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en
The action "cleanDeletedSIDsFrom" removes SIDs that cannot be resolved from files/folders.
The domain can be specified as parameter.
Sample:
subinacl /subdirectories c:\data\*.* /cleandeletedsidsfrom=MyDomain
Caution:
Depending on the amount of data this can be quite time and ressource consuming.
Patrick- Marked as answer by tnetplus Monday, August 24, 2009 11:11 PM
Monday, August 24, 2009 8:36 PM -
Hi.
Would take a look into subinacl:
subinacl /subdirectories c:\* /cleandeletedsidsfrom=example
http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en- /cleandeletedsidsfrom=DomainName [=dacl | =sacl | =owner | =primarygroup | =sdsize]
- Deletes all ACEs containing deleted (not valid) SIDs from DomainName. The optional parameters allow you to specify certain parts of the security descriptor in which to search for invalid SIDs.
I belive you can run this program with a /testmode option or something to test before doing anything.
Good luck with your summer cleaning :-)
OHMMonday, August 24, 2009 8:43 PM -
Awsome made quick light work of it.Monday, August 24, 2009 11:12 PM