Solved

identifying orphaned SIDs

Posted on 2009-07-13
5
2,168 Views
Last Modified: 2012-06-21
when looking at permissions for groups and files, from time to time i run accross some orphaned SIDs. is there a way to identify the orphaned SIDs to delete? how should these be handled?
0
Comment
Question by:geriatricgeek
  • 3
  • 2
5 Comments
 
LVL 4

Expert Comment

by:Viper640
ID: 24841292
http://itknowledgeexchange.techtarget.com/itanswers/managing-orphaned-sids-on-ad-objects/ - Uses groups instead of users to prevent orphans.

http://support.microsoft.com/kb/243330 - Well known sids in Windows

http://www.scriptinganswers.com/forum2/forum_posts.asp?TID=1501 - Script to find orphaned Sids in AD

HTH

Viper640
0
 
LVL 1

Author Comment

by:geriatricgeek
ID: 24842065
do i run the script on the domain controller?
0
 
LVL 4

Expert Comment

by:Viper640
ID: 24842421
yes, it's a vb script. so copy to a notepad and save as a vbs ext and run it.
0
 
LVL 1

Author Comment

by:geriatricgeek
ID: 24852439
is there a way to look at the script? it does not open in notepad like other vbs'.
0
 
LVL 4

Accepted Solution

by:
Viper640 earned 500 total points
ID: 24852865
Here it is i just opened it with notepad. let me know if you need anything else.

Viper640
'Created by Michael Troy Mckee

'Date 10/05/06

'VbScript to check all running machines on a domain

'for orphaned SIDs.
 
 

Const ADS_SCOPE_SUBTREE = 2
 

Set objConnection = CreateObject("ADODB.Connection")

Set objCommand =   CreateObject("ADODB.Command")

objConnection.Provider = "ADsDSOObject"

objConnection.Open "Active Directory Provider"
 

Set objCommand.ActiveConnection = objConnection

objCommand.CommandText = _

    "Select Name from 'LDAP://DC=yourdomain,DC=com' " _

        & "Where objectClass='computer'"

objCommand.Properties("Page Size") = 1000

objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE

Set objRecordSet = objCommand.Execute

objRunningComp = 0

objDownComp = 0

objRecordSet.MoveFirst
 

On Error Resume Next
 

Do Until objRecordSet.EOF
 

    hostComp = objRecordSet.Fields("Name").Value

    strComputer = "."
 

    Set objWMIService = GetObject("winmgmts:" _

        & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 

    queryString = "Select * from Win32_PingStatus Where Address = '" & hostComp & "'"

    'Wscript.Echo queryString

    Set colPingedComputers = objWMIService.ExecQuery(querystring)
 
 

        For Each objComputer in colPingedComputers

            Set colGroups = GetObject("WinNT://" & hostComp & "")

            'Wscript.Echo hostComp

            colGroups.Filter = Array("group")

            For Each objGroup In colGroups

            'Wscript.Echo objGroup.Name

            For Each objUser in objGroup.Members

                'Set sidName = objUser.Name

                'Wscript.Echo sidName

                If Left(objUser.Name, 8) = "S-1-5-21" Then

                Wscript.Echo hostComp

                Wscript.Echo objGroup.Name

                Wscript.Echo vbTab & objUser.Name

            End If

        Next
 

      Next

    Next
 

    objRecordSet.MoveNext

Loop
 

'Wscript.Echo "There are " & objRunningComp & " machines currently active."

'Wscript.Echo "There are " & objDownComp & " machines not responding."

Open in new window

0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

There are two modes of restricted groups GPOs. Replacing mode:   Additive mode:   How do they work? Replacing mode: Everything (users, groups, computers) that is member of the local administrators group will be cleared out. After th…
The saying goes a bad carpenter blames his tools. In the Directory Services world a bad system administrator, well, even with the best tools they’re probably not going to become an all star.  However for the system admin who is willing to spend a li…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now