0

So our security auditors sent me an email indicating there were a few AD groups and accounts in the administrators group of one of our servers that should not have admin access to the machine in question. When I go into Computer Management-->Groups-->Administrators, I do not see any of the accounts indicated, but I see a lot of entries like:

S-1-5-21-484763869-823518204-83922115-105014

This is on a Windows Server 2000 machine. Obviously there must be a way to get the plain text list of accounts since the auditors sent me a spreadsheet with the list of accounts on each machine, but I'm not sure how to get them displayed properly on the screen where I can add/remove accounts from the group.

Brandon
  • 133
  • 1
  • 1
  • 6

1 Answers1

7

What you're seeing is the SID (Security Identifier) of an object. Generally, Windows is nice enough to automatically translate this SID into a user's display name for you in the Security dialog, so that you don't have to hunt for it, but if a Domain Controller is unable to be contacted when the ACL is being viewed, you'll see a SID. You'll also see this SID if the user/group/computer no longer exists in Active Directory.

If you're seeing a mix of SID and display names, then you're likely looking at something that's been deleted in AD. If you're looking at a complete list of only SIDs, then something is wrong with your directory services environment and you should figure out why this server is unable to contact a DC to show you this translation. You may have a domain controller offline, or a networking problem.

The SID is a searchable attribute, though. So you can query AD using the ADUC snap-in, or PowerShell, or any other method you might already be familiar with.

MDMarra
  • 100,734
  • 32
  • 197
  • 329
  • 1
    +1 and you can "try" to use PSGetSID: http://technet.microsoft.com/en-us/sysinternals/bb897417 if you want. – TheCleaner Sep 09 '13 at 14:43