Remove ghost users entries from ACLs

Posted on 2007-07-31
Last Modified: 2013-12-02

I'm looking at a Windows Server 2003 fileserver in my company at the moment and I noticed that there is a lot of directories which has ghost user entries in their ACL.
Very likely, some users had specific permissions to these directories but their user accounts have been deleted from Active Directory and they are now left as SID-etc... "ghost" users...

I would like to do a clean-up : is there any quick way to remove all the ghost entries in a path recursively ?
I would prefer not do it through the GUI in each folder since there seems to be a lot of individual folders with ghost entries in their ACLs.

Thanks a lot in advance.
Question by:Vorenus
    LVL 82

    Accepted Solution

    You can do that with subinacl; this should work (replace D:\Data with the root folder to process; try with a test folder first):
    subinacl /subdirectories D:\Data\*.* /cleandeletedsidsfrom=%Userdomain%

    Download details: SubInACL (SubInACL.exe)

    And that's one of the reasons you don't give permissions to individual accounts, but using the AG(D)LP model instead: *A*ccounts are members of *G*lobal groups, global groups are members of (*D*omain) *L*ocal groups, *P*ermissions are assigned to local groups.
    LVL 16

    Expert Comment

    Subinacl should be your tool of choice:


    subinacl /subdirectories <folderpath>\*.* /cleandeletedsidsfrom=<domain>
    LVL 4

    Author Comment

    Thanks, exactly what I needed !


    Featured Post

    Integrate social media with email signatures

    Is your company active on social media? Do you also use email signatures? Including social media icons in your email signature is a great way to get fans for free. Let all your email users know you’re on social media quickly and easily, in a single click.

    Join & Write a Comment

    Have you ever stumbled upon a software that is so great that you just love? It happened to me. Love at first sight. Filezilla Server.   Ok its not the most advanced ftp server I've came across. But its a fairly simple piece of software to get the …
    A quick step-by-step overview of installing and configuring Carbonite Server Backup.
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now