Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

identifying orphaned SIDs

Posted on 2009-07-13
5
Medium Priority
?
2,370 Views
Last Modified: 2012-06-21
when looking at permissions for groups and files, from time to time i run accross some orphaned SIDs. is there a way to identify the orphaned SIDs to delete? how should these be handled?
0
Comment
Question by:geriatricgeek
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 4

Expert Comment

by:Viper640
ID: 24841292
http://itknowledgeexchange.techtarget.com/itanswers/managing-orphaned-sids-on-ad-objects/ - Uses groups instead of users to prevent orphans.

http://support.microsoft.com/kb/243330 - Well known sids in Windows

http://www.scriptinganswers.com/forum2/forum_posts.asp?TID=1501 - Script to find orphaned Sids in AD

HTH

Viper640
0
 
LVL 1

Author Comment

by:geriatricgeek
ID: 24842065
do i run the script on the domain controller?
0
 
LVL 4

Expert Comment

by:Viper640
ID: 24842421
yes, it's a vb script. so copy to a notepad and save as a vbs ext and run it.
0
 
LVL 1

Author Comment

by:geriatricgeek
ID: 24852439
is there a way to look at the script? it does not open in notepad like other vbs'.
0
 
LVL 4

Accepted Solution

by:
Viper640 earned 2000 total points
ID: 24852865
Here it is i just opened it with notepad. let me know if you need anything else.

Viper640
'Created by Michael Troy Mckee
'Date 10/05/06
'VbScript to check all running machines on a domain
'for orphaned SIDs.
 
 
Const ADS_SCOPE_SUBTREE = 2
 
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
 
Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "Select Name from 'LDAP://DC=yourdomain,DC=com' " _
        & "Where objectClass='computer'"
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.Execute
objRunningComp = 0
objDownComp = 0
objRecordSet.MoveFirst
 
On Error Resume Next
 
Do Until objRecordSet.EOF
 
    hostComp = objRecordSet.Fields("Name").Value
    strComputer = "."
 
    Set objWMIService = GetObject("winmgmts:" _
        & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 
    queryString = "Select * from Win32_PingStatus Where Address = '" & hostComp & "'"
    'Wscript.Echo queryString
    Set colPingedComputers = objWMIService.ExecQuery(querystring)
 
 
        For Each objComputer in colPingedComputers
            Set colGroups = GetObject("WinNT://" & hostComp & "")
            'Wscript.Echo hostComp
            colGroups.Filter = Array("group")
            For Each objGroup In colGroups
            'Wscript.Echo objGroup.Name
            For Each objUser in objGroup.Members
                'Set sidName = objUser.Name
                'Wscript.Echo sidName
                If Left(objUser.Name, 8) = "S-1-5-21" Then
                Wscript.Echo hostComp
                Wscript.Echo objGroup.Name
                Wscript.Echo vbTab & objUser.Name
            End If
        Next
 
      Next
    Next
 
    objRecordSet.MoveNext
Loop
 
'Wscript.Echo "There are " & objRunningComp & " machines currently active."
'Wscript.Echo "There are " & objDownComp & " machines not responding."

Open in new window

0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
Let's recap what we learned from yesterday's Skyport Systems webinar.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

671 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question