Solved

identifying orphaned SIDs

Posted on 2009-07-13
5
2,217 Views
Last Modified: 2012-06-21
when looking at permissions for groups and files, from time to time i run accross some orphaned SIDs. is there a way to identify the orphaned SIDs to delete? how should these be handled?
0
Comment
Question by:geriatricgeek
  • 3
  • 2
5 Comments
 
LVL 4

Expert Comment

by:Viper640
ID: 24841292
http://itknowledgeexchange.techtarget.com/itanswers/managing-orphaned-sids-on-ad-objects/ - Uses groups instead of users to prevent orphans.

http://support.microsoft.com/kb/243330 - Well known sids in Windows

http://www.scriptinganswers.com/forum2/forum_posts.asp?TID=1501 - Script to find orphaned Sids in AD

HTH

Viper640
0
 
LVL 1

Author Comment

by:geriatricgeek
ID: 24842065
do i run the script on the domain controller?
0
 
LVL 4

Expert Comment

by:Viper640
ID: 24842421
yes, it's a vb script. so copy to a notepad and save as a vbs ext and run it.
0
 
LVL 1

Author Comment

by:geriatricgeek
ID: 24852439
is there a way to look at the script? it does not open in notepad like other vbs'.
0
 
LVL 4

Accepted Solution

by:
Viper640 earned 500 total points
ID: 24852865
Here it is i just opened it with notepad. let me know if you need anything else.

Viper640
'Created by Michael Troy Mckee
'Date 10/05/06
'VbScript to check all running machines on a domain
'for orphaned SIDs.
 
 
Const ADS_SCOPE_SUBTREE = 2
 
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
 
Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "Select Name from 'LDAP://DC=yourdomain,DC=com' " _
        & "Where objectClass='computer'"
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.Execute
objRunningComp = 0
objDownComp = 0
objRecordSet.MoveFirst
 
On Error Resume Next
 
Do Until objRecordSet.EOF
 
    hostComp = objRecordSet.Fields("Name").Value
    strComputer = "."
 
    Set objWMIService = GetObject("winmgmts:" _
        & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 
    queryString = "Select * from Win32_PingStatus Where Address = '" & hostComp & "'"
    'Wscript.Echo queryString
    Set colPingedComputers = objWMIService.ExecQuery(querystring)
 
 
        For Each objComputer in colPingedComputers
            Set colGroups = GetObject("WinNT://" & hostComp & "")
            'Wscript.Echo hostComp
            colGroups.Filter = Array("group")
            For Each objGroup In colGroups
            'Wscript.Echo objGroup.Name
            For Each objUser in objGroup.Members
                'Set sidName = objUser.Name
                'Wscript.Echo sidName
                If Left(objUser.Name, 8) = "S-1-5-21" Then
                Wscript.Echo hostComp
                Wscript.Echo objGroup.Name
                Wscript.Echo vbTab & objUser.Name
            End If
        Next
 
      Next
    Next
 
    objRecordSet.MoveNext
Loop
 
'Wscript.Echo "There are " & objRunningComp & " machines currently active."
'Wscript.Echo "There are " & objDownComp & " machines not responding."

Open in new window

0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

789 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question