Default domain controller policy - SID rather than name

[steveg]

Going through and removing a couple of things from the default domain policy that shouldn't be in there, before I did this I backed up the default domain and default domain controllers policy.

 

Backing up the default domain controller policy came up with an error. I've had a look through the settings in there and there are some under user rights assignment that have SIDs starting with a * listed instead of names. They do also have the groups / local service etc accounts that I would expect to see in there.

 

I'm assuming these are most likely for old deleted accounts that have at some point not deleted as they should, and I should be safe to remove them? Just wanted a second opinion before I remove them!

[Boredguy]

Yes you can remove them as they are deleted

[steveg]

Yes you can remove them as they are deleted

 

Thanks, one of those things where I was 99% sure but wanted the reassurance before I did!

[psydii]

Watch out - I think sometimes those SIDs relate to accounts inside an IIS install on a DC.... (its been ages since I looked at this, but not all unnamed SIDs were deleted accounts).

 

https://www.bing.com/search?q=SID+group+policy+IIS+domain+controller

Edited November 19, 2021 by psydii

[steveg]

Watch out - I think sometimes those SIDs relate to accounts inside an IIS install on a DC.... (its been ages since I looked at this, but not all unnamed SIDs were deleted accounts).

 

https://www.bing.com/search?q=SID+group+policy+IIS+domain+controller

 

I've deleted them now :-) No IIS on the domain controller, so should be ok!