Unresolved SID count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-15

Overview

Unresolved SIDs in DACLs often indicate deleted users or groups, stale migration artifacts, or incomplete cleanup.

• Stale delegation detection: Old ACEs can remain after identities are removed
• Operational hygiene: Orphaned SID references make permissions harder to review and audit
• Migration validation: Unresolved SIDs can reveal accounts that were not fully remapped or retired

Control Type

Operational

Security Recommendation

• Investigate unresolved SID ACEs and determine whether they can be removed
• Validate that deprovisioning and migration processes clean up obsolete permissions
• Review privileged containers first, where stale ACEs can cause confusion during incident response

How the Test Works

This test reads $adState.DaclEntries and looks for entries whose IdentityReference starts with S-1-5-21, which commonly indicates a SID that did not resolve to a friendly name.

Related Tests

• Test-MtAdDaclUnresolvedSidDetails - Lists unresolved SID references by object
• Test-MtAdDaclDistinctIdentityCount - Counts distinct identities present in ACEs
• Test-MtAdDaclIdentityAceDistribution - Shows ACE distribution across identities

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-15
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	Permission
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclUnresolvedSidCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-15.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-15.md