Unresolved SID details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-16

Overview

Knowing which directory objects contain orphaned SID ACEs helps target cleanup work where it matters most.

• Object-focused remediation: Grouping unresolved SIDs by object shows exactly where stale ACEs exist
• Audit clarity: Makes manual DACL review easier during privileged access assessments
• Change tracking: Helps confirm whether decommissioned identities still linger on important objects

Control Type

Operational

Security Recommendation

• Remove orphaned ACEs after confirming the referenced SID is no longer valid
• Prioritize cleanup on privileged OUs, admin groups, and delegation-heavy containers
• Document recurring sources of unresolved SIDs to improve identity lifecycle processes

How the Test Works

This test reads $adState.DaclEntries, filters unresolved IdentityReference values that begin with S-1-5-21, and groups them by ObjectDN.

Related Tests

• Test-MtAdDaclUnresolvedSidCount - Counts unresolved SID references
• Test-MtAdDaclNonInheritedAceCount - Counts explicit ACEs that may require review
• Test-MtAdDaclInheritedObjectTypeDetails - Shows inheritance targeting across ACEs

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-16
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	Permission
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclUnresolvedSidDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-16.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-16.md