Unknown S-I-D

[Koldov]

TL;DR - should I care about random SID (unknown AD objects) on the servers?

 

Thanks to Ping Castle, I think I might be getting a little OCD...

 

Further to my recent posts regarding unknown SID (which proved fruitless) I'm now wondering if I should really even be bothered, so I wonder how many others have any sort of problem with these...?

 

From silly things like file and folder permissions or owners to some seemingly more serious instances.

 

From my Default Domain Controller Policy - Local Policies - User Rights Assignment:

 

Adjust memory quotas for a process

 

S-1-5-80-3872966011-708220999-3221348760-278086016-495090482

S-1-5-80-1027379678-474908837-1028915040-3930802918-515684020

 

From a quick Google search - S-1-5-80 is an NT Service account prefix... which NT service though?

 

They appear in quite a few other sections too, but I can't find them as AD objects (and neither can Windows I guess) because they have been deleted at some point.

 

I also have:

 

Deny access to this computer from the network and Deny log on locally ...

 

MYDOMAIN\SUPPORT_388945a0

 

...which luckily I haven't deleted (yet) just disabled for now and this reports to be from:

 

CN=Microsoft Corporation,L=Redmond,S=Washington,C=US

This is a vendor's account for the Help and Support Service

 

But anyway if and when I delete it, I guess it will just show an unknown SID in the permissions like the others.

 

What should happen to things like these permissions when the user is deleted and is there a (safe) way to clean them up?

 

On the file server there are entire file directories with an SID as the owner (and all the folders and files within), does it matter?

Edited June 23, 2021 by Koldov

[free780]

Unknown SIDs in local groups break Get-LocalGroupMembers. If you allocate AD groups as members of local groups you get less of this issue unless tou delete the AD group.