Question

Managing Orphaned SIDs on AD objects

Exchange security, Windows, Security, Development, Developers

We discovered that many distribution groups have had individual permissions assigned using the security tab. Primarily this is because the 'managedBy' field allows only 1 manager to control membership of the group. Unfortunately when a user is removed from AD the SID is left behind on the various objects the user was granted permission to.

Does an application exist that would identify orphaned SIDs on objects and remove them? If not, how would you recommend removing the orphaned SIDs?

the only way I have found is to do it manually. what needs to be done is a process change. you need to setup security groups to apply the security rights to. then you add the users to the group. then when the user account is deleted AD will remove the account from the groups and there will only be the groups left on the ACL list instead of orphaned SIDs.