Group Policy - Unknown SID's

In Default Domain Policy : Computer Configuration-->Policies-->Windows Settings-->Security Settings-->Local Policies-->User Rights Assignment we have many policies with unknown SID's. All of them begin with *S-1-5-21. Are these unknown SID's safe to delete from the policy or are some of them actually being used somewhere and they are just not resolving to a User or a Group.

Plan is to back up the Default Domain Policy, delete the unknown SID's, do a gpupdate /force, and then reboot clients,

So I'm looking for any of the gotcha's in this, really would like to clean this up...

V
LVL 10
Vince GlissonOwnerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Keith LangmeadCommented:
It doesn't really answer your question, but have a look at http://support.microsoft.com/kb/243330 which lists all the commonly known SIDs and may allow you to identify what the group is for.

From the document all the S-1-5-21 SIDs appear to relate to various default domain groups, for instance Domain Administrator, Domain Users etc, but the crucial info comes after the bit you listed. If the domain part of the SID is different to your current domain then perhaps they relate to an old domain that was part of it in the past and no longer there, or perhaps there's an actual issue with AD such that those names are unable to resolve (in which case I'd suggest you need to fix that, not just delete the groups).
0
Vince GlissonOwnerAuthor Commented:
The well known SID's all end with a 500 series number as in S-1-5-21-domain-500 , 501, 502 etc...

The SID's i have all end with 4 digits -3326 thru 3346 so there are 20 unknown SID's in one policy (logon as a service).

There are so many i wanted to ask the Experts before i attempted a clean up...

v
0
Liam SomervilleSenior Security ConsultantCommented:
I'd suggest the following:

1. Try manually resolving SIDs to Users/Groups (http://technet.microsoft.com/en-us/library/ff730940.aspx)
2. Get your hands on a blank Default Domain Policy. I've attached one, but you may want to spin up your own VM and pull a report.
3. Remove the unresolved SIDs, readd users/groups if required, or otherwise mirror your Default Domain Policy.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.