In Default Domain Policy : Computer Configuration-->Policies-->Windows Settings-->Security Settings-->Local Policies-->User Rights Assignment we have many policies with unknown SID's. All of them begin with *S-1-5-21. Are these unknown SID's safe to delete from the policy or are some of them actually being used somewhere and they are just not resolving to a User or a Group.
Plan is to back up the Default Domain Policy, delete the unknown SID's, do a gpupdate /force, and then reboot clients,
So I'm looking for any of the gotcha's in this, really would like to clean this up...