I should point out that you can get dangling SIDs even when the relevant user or group is still in the AD. The scenario involves SID History and the migration of security principals from one domain to another.
Suppose a security principal, say user X with SID X is migrated from domain A to domain B. (Let's keep everything in the same forest to make it interesting.) The new object, user Y, in domain B will now have a new SID Y and SID X will be placed in the SID History attribute of the object. The resources back in domain A that user X had permissions to directly will still have ACEs that refer to SID X. Windows uses the SID history to allow user Y to have access back to the resource in domain A. Kind of like having dual citizenship. At some point after user X is migrated, the AD administrators decide that user formerly known as user X has had enough time on the fence (or have found that the user is experiencing token bloat but that's a topic for another message) and cleans out SID X from the SID History for user Y. Unless something is done to touch all the objects in domain A that might refer to SID X and replace it with SID Y, user Y will lose access to those resources and ACEs that refer to SID X will remain in the ACLs for those resources. This is the case for anywhere that SID X is referenced even though the user formerly known as X (i.e. user Y) is still in the AD. The difficulty of hunting down all the references to SID X is further complicated if there are any group policies that refer to SID X or if there are any domains that trusted domain A that could then make reference to SID X in an ACL somewhere. And let's not forget that there may also be references to SID X inside a variety of data stores such as but not limited to SQL, Exchange mailboxes, etc. And just because a SID doesn't back-translate, it doesn't mean that the object is really gone. Itcould just mean that the domain that is responsible for the translation is temporarily unavailable, so it's best to double check that the SID is really defunct before purging any references to it. Wook From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Paul Williams Sent: Thursday, January 04, 2007 7:29 AM To: ActiveDir@mail.activedir.org Subject: Re: RE: [ActiveDir] SID Deleted users remains in NTS permission. Because it's not managed by the DS. The SID as you refer to it is actually an ACE. The ACE is an item that makes up the DACL which makes up the ACL. This is managed locally by the member server. Windows itself. The LSA. It's far too expensive and problematic with the current design for this to auto-manage itself. Re-read Joe's post. The DS doesn't know or care where a security principal is referenced as an ACE in an ACL. And the computer in question shouldn't really auto-prune the ACEs based on a rule or two... --Paul ----- Original Message ----- From: Haritwal, Dhiraj<mailto:[EMAIL PROTECTED]> To: ActiveDir@mail.activedir.org<mailto:ActiveDir@mail.activedir.org> Sent: Thursday, January 04, 2007 3:18 PM Subject: RE: RE: [ActiveDir] SID Deleted users remains in NTS permission. But still the actual discussion is pending. If someone is having a single folder which is mapped to a single user. So in that case how we can use groups & suppose tomorrow this user left the organization & his account got deleted, SID will come on to the permission of that folder. If I am not wrong the actual discussion was why SID is coming after deleted an account. Why it's not getting deleted automatically. Dhiraj Haritwal ________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe Sent: Thursday, January 04, 2007 7:18 PM To: ActiveDir@mail.activedir.org Subject: RE: RE: [ActiveDir] SID Deleted users remains in NTS permission. Not sure why this suprises you. The ACLs are not maintained by AD nor the SAM where the user accounts exist which means you either get to poll or put some form of notification system in process. Consider also the case of trusted security principals, systems don't get a notification when a trusted system deletes a security principal. Here are just a couple of the bad things that could happen if the machines were responsible for cleaning up those SIDs 1. Overhead. Do you know the sheer number of Security Descriptors that are on any given system? You are just thinking of file Security Descriptors but there are Security Descriptors on many many different securable objects. I have published the list of items I at least know about to this list on a couple of occasions and the different types of objects alone is double digits let alone the actual instants of those objects. Consider a file system with hundreds of thousands or millions of Security Descriptors with really long ACL chains. You could have a scavenger thread running 24x7 in idle mode (you wouldn't want it higher as it would eat up CPU and that would be a different complaint) just constantly walking the ACLs and verifying them. 2. Mistakes. Since we don't have a change notification capability for deleted security principals, and quite honestly you wouldn't (could you imagine 300,000 machines registering with every domain in your forest for change notifications of security principal changes) so that leaves polling and lets say you have a tempory network glitch that makes a SID unresolvable to a friendly name... Do you then just start stripping the SIDs from the ACLs because a name can't be resolved once, twice, three times? What about when an account gets undeleted or restored because it was accidently deleted for an hour? I can think of even more bad things but don't have the time to write about them. If you want to, think through how you would build an application to do what you are suggesting. It is always a good thought exercise before being surprised at what MSFT has done. Keep in mind they are a collection of really bright programmers that often have to work in committee, they aren't necessarily miracle workers. Could this be done? Maybe. I think could visualize mechanisms to possibly help here but would really have to think it through even more than I have and I have thought a lot about things like this... But it would take serious rework with how security is implemented on Windows and I would be quite fearful of the scaling capabilities. The Windows security system is difficult to work with and can be quite a pain but it is extremely flexible and powerful at the same time. I have started and stopped several times to write all inclusive security tracking tools, it is a big big deal and if done wrong will really make someone have a bad day. As someone else mentioned, use groups. Don't use users. When you go to delete a group, make it a point to clean up where that group has been used. If you don't know where it has been used, that is a process issue and one of the reasons why I am not a fan of universal and global groups because the scope of use is huge. Alternately write your own tools to scan all of the various ACLs looking for unresolvable SIDs and clean them up, but I would be shy on how agressive you are with the cleanup. You can easily screw yourself up. joe -- O'Reilly Active Directory Third Edition - http://www.joeware.net/win/ad3e.htm ________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Yann Sent: Thursday, January 04, 2007 5:35 AM To: ActiveDir@mail.activedir.org Subject: RE : RE: [ActiveDir] SID Deleted users remains in NTS permission. Thanks for replying. You say that it is normal that the sid still remains in file & directory ACLs after the deletion of the corresponding group ?? I always thought that sids *HAVE TO* disapear dynamically on all existing ACLs set on file server. I'm a bit surprise that the system (AD<->file server) leave this dirty sid and that there is no synchronisation that updates the "link" between the AD object and the ACE.... What is the reason ? could this behavior be altering ? I'd like sid disappears after deletion of the corresponding group in AD in order to not have this dirty SIDs... Thanks. Yann "Akomolafe, Deji" <[EMAIL PROTECTED]> a écrit : It's "normal". You should be permissioning your resources with groups instead of directly with user accounts. Groups tend to last longer, so you don't have to deal with the horrible SIDs. Sincerely, _____ (, / | /) /) /) /---| (/_ ______ ___// _ // _ ) / |_/(__(_) // (_(_)(/_(_(_/(__(/_ (_/ /) (/ Microsoft MVP - Directory Services www.akomolafe.com<x-excid://32770000/uri:http:/www.akomolafe.com> - we know IT -5.75, -3.23 Do you now realize that Today is the Tomorrow you were worried about Yesterday? -anon ________________________________ From: Yann Sent: Thu 1/4/2007 1:52 AM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] SID Deleted users remains in NTS permission. Hello all & Happy new year ! :) AD 2k3 sp1 in FFL mode. When i delete a user or group from AD, and these objects have permissions on ntfs permissions, i usually see their sids remaining in those file & directory ACLs. Is this normal ? If not,what could be the reason(s) & how to investigate this issue ? Thanks, Yann __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail ________________________________ This email is confidential and intended only for the use of the individual or entity named above and may contain information that is privileged. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this email is strictly prohibited. If you have received this email in error, please notify us immediately by return email or telephone and destroy the original message. - This mail is sent via Sony Asia Pacific Mail Gateway. ________________________________
