Any way to mass remove unresolve SIDs from NTFS permissions?

Posted on 2011-05-09
Medium Priority
Last Modified: 2013-12-04

I am attempting a data from our file server to an open CIFS share in preparation for putting some of our data onto a cloud provider.  The problem I am running into is that the migration tool I am using cannot set the file/folder permissions properly because a number of my folders have unresolved SID entries (the folders are old, first created about 15 years ago, and have been migrated through at least four different servers and an NT -> 2000 - > 2003 domain at this point).  Many of the folders, especially the older ones, are a mess of nested folders and non-inheritance.

Since I can't easily go through the thousands of folders and files and see which have unresolved SIDs in their permissions and which don't, is there any way to remove all unresolved SIDs en masse?  Or barring that, any way to at least list which objects hold them?

Oh, the files currently reside on a Windows 2008 server.


Question by:Jason_Place
LVL 24

Accepted Solution

Mike Thomas earned 2000 total points
ID: 35726733
These will be the SID's for deleted AD Objects.

You can use SubInACL to do this for you.

LVL 62

Expert Comment

ID: 35727339
chkdsk /f also does some cleanup.

Author Closing Comment

ID: 35728237
Perfect, that's exactly the sort of thing I was looking for.  Thanks!

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Suggested Courses

755 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question