Member Avatar for www.bitsel.com

Hi there ,
After I have demoted my windows 2000 advanced server from Domain Controller to a member server I decided to use DCPROMO again , to Promote that server to a DC again. It worked well . But : when users log in to the Domain , they have difficulties with running Logon and Logof scripts and startup and shut down scripts as well . I still see in the security tab of my files the UID s of the old Domain . I think there must be some kind of mix up with the security ID`s . Strange thing is : the logon Process runs well . I wanted to ask now , if there is a way to clean up the previous active directoruy completely ( since dcpromo does`nt seem to remove some old sec ID s ) .
Any suggestions ?
thanks alot

  • 2 Contributors
  • 2 Replies
  • 138 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by feigned

Dani AI

Generated

A concise, practical recovery plan for based on the thread and 's pointer.

When a domain is dismantled and rebuilt the underlying security identifiers (SIDs) that ACLs store do not automatically remap. That leaves “orphan” SIDs in NTFS and GPO ACLs that can block script access even when authentication itself works. Two parallel tracks fix this: clean up AD metadata and remove stale SIDs from file/GPO ACLs.

Do AD-level cleanup first: remove stale computer/service accounts in Active Directory Users and Computers, and use ADSIEdit only when the GUI cannot see an object. If a DC was removed improperly run metadata cleanup (ntdsutil) to remove leftover server objects. Take screenshots/export lists before you delete. ADSIEdit overview: . Read about how SIDs map to accounts: Security Identifiers (SIDs).

Then fix ACLs on shares and GPOs. Backup ACLs first with icacls, then detect and remove orphan entries. Example backup command and docs: icacls

icacls "C:\Shares" /save "C:\backups\acls.txt" /t

Quick PowerShell to list unresolved SIDs under a root (modify $root):

$root = 'C:\Shares'
Get-ChildItem -Path $root -Recurse -Force | ForEach-Object {
  $path = $_.FullName
  $acl = Get-Acl -Path $path -ErrorAction SilentlyContinue
  if ($acl) {
    foreach ($ace in $acl.Access) {
      try { $ace.IdentityReference.Translate([System.Security.Principal.NTAccount]) | Out-Null }
      catch {
        [PSCustomObject]@{ Path=$path; SID=$ace.IdentityReference.Value; Rights=$ace.FileSystemRights }
      }
    }
  }
}

To remove a specific orphan ACE from a folder:

$path = 'C:\Shares\SomeFolder'
$acl = Get-Acl -Path $path
$orphan = $acl.Access | Where-Object { $_.IdentityReference.Value -eq 'S-1-5-21-....' }
foreach ($r in $orphan) { $acl.RemoveAccessRuleSpecific($r) }
Set-Acl -Path $path -AclObject $acl

After ACL fixes verify Group Policy and script delivery (use gpresult /h report.html) and check client Event Viewer for GP or script errors: gpresult. Test on a small share first and keep ACL backups so you can roll back.

Recommended Answers

All 2 Replies

Member Avatar for feigned

Hi there ,
After I have demoted my windows 2000 advanced server from Domain Controller to a member server I decided to use DCPROMO again , to Promote that server to a DC again. It worked well . But : when users log in to the Domain , they have difficulties with running Logon and Logof scripts and startup and shut down scripts as well . I still see in the security tab of my files the UID s of the old Domain . I think there must be some kind of mix up with the security ID`s . Strange thing is : the logon Process runs well . I wanted to ask now , if there is a way to clean up the previous active directoruy completely ( since dcpromo does`nt seem to remove some old sec ID s ) .
Any suggestions ?
thanks alot
www.bitsel.com

I don't think you can mass prune anything out of A.D.

If all you're doing is deleting SID's from directory permissions, I wouldn't worry much at all about it. Just if you come across them in the future, delete them. They're not hurting anything by being shown.

Member Avatar for feigned

Actually, you may be able to use the Active Directory Cleanup wizard. Google for it or check out Microsoft's site to download it.

The operative word in the first sentence is may.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.