{"repo":"tomstryhn/Active-Directory-Unknown-SID","free":true,"listed":false,"github":"https://github.com/tomstryhn/Active-Directory-Unknown-SID","clone":"git clone https://github.com/tomstryhn/Active-Directory-Unknown-SID.git","description":"A small guide on Unknown/Orphaned SIDs and some PowerShell tools to help you get rid of them.","language":null,"stars":21,"topics":["unknown-sid","unknownsid","unresolved-sid","unresolvedsid","orphaned-sid","orphanedsid","active-directory","microsoft","windows","cybersecurity"],"license":"MIT","category":"security-tools","readme_excerpt":"Active Directory Unknown SID Unknown SID, Orphaned SID or Unresolvable SID, all three terms cover the same issue, an issue that many AD Administrators, at some point have encountered and/or are struggling with, not to mention the hassle to get them all removed. I will with this guide try and cover some of the risks introduced by Unknown SIDs, and supply some code samples and scripts, that might help you mitigating this risk. Table of Contents - What is an Unknown/Orphaned/Unresolvable SID? - Basic SID 101 - How do they become Unknown/Orphaned/Unresolvable? - Risk(s) - Mitigation - Documented processes on deleting objects in Active Directory - Remember to remove the SIDHistory from your Security Principals - Audit your ACL's on a regular basis - Toolbox - Basic PowerShell commands - SID lookup - Getting ADObjects with a SIDHistory - Example: Removing the SIDHistory from an ADUser - Scripts - Get-UnresolvableSIDsFromADObjectACLAccessRules - Modules - ADObjectOwner - Links What is an Unknown/Orphaned/Unresolvable SID? To understand what it is, you need to have a little insight, and first need to know what a SID is. Basic SID 101 SID - or the Security Identifier, is in short a unique identifier used in your Active Directory, among other places. Below is displayed the output when you get the SID from a ADUser, using PowerShell: This is a sample SID for the domain administrator of our fictive AD. (Tip: The builtin Administrator always ends with '-500') A SID uniquely identifies Sec","default_branch":null,"files":null,"tree":[],"storefront":"/r/tomstryhn","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/tomstryhn/Active-Directory-Unknown-SID/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}