Security Explorer CLI does not support “Revoke all unknown and deleted accounts” functionality (4383794)

Security Explorer CLI does not support “Revoke all unknown and deleted accounts” functionality

What the GUI Feature Does

The GUI option “Revoke all unknown and deleted accounts” performs an automated cleanup operation that:

1. Identifies unknown SIDs (SIDs that no longer resolve to Active Directory objects)
2. Detects deleted accounts (tombstoned or permanently removed)
3. Removes the corresponding Access Control Entries (ACEs) from selected resources

This logic includes built-in SID resolution and validation mechanisms that are not implemented in the CLI tools.

---

What the CLI Supports

The Security Explorer CLI utilities (including SxpRevoke.exe) support:

• Removing explicitly specified ACEs
• Revoking permissions for specific accounts or SIDs
• Applying template-based permission resets
• Copying or replacing ACLs

CLI Limitations

The CLI cannot:

• Automatically detect unknown or unresolved SIDs
• Identify deleted Active Directory accounts
• Perform bulk intelligent cleanup based on SID resolution
• Replicate the GUI’s automated detection logic

There are no hidden or undocumented parameters to enable this functionality via CLI.

---

Workarounds

1. PowerShell + CLI Approach

You can approximate the functionality by:

Step 1 – Identify unresolved/unknown SIDs:

PowerShell

Step 2 – Revoke permissions using CLI:

BAT

⚠️ Note: This requires custom scripting and does not fully replicate GUI intelligence.

---

2. Use Security Explorer GUI (Recommended)

The GUI remains the only fully supported method to:

• Automatically detect unknown/deleted accounts
• Perform bulk cleanup across folder structures
• Execute this operation safely and efficiently

At this time, there is no CLI equivalent to the Security Explorer GUI feature: “Revoke all unknown and deleted accounts” This functionality remains exclusive to the GUI, and any CLI-based workaround requires manual identification and scripting.