Return
-
Title
Every time we RE-ACL a share, this unknown SID appears. Its not a well-formed sid. Extra long, extra section -
Description
we notice every time we RE-ACL a share, this unknown SID appears. For example:
“S-1-543216-0-5-21-1958598506-4226054213-273437955-514”
It's not a well-formed sid. Starts off ok. Appears to be a partial SID that gets added into the middle.We don’t know where that is coming from. Not related to the 10 groups or users they migratedThe only difference is 4226054213 section in the middle.And that middle part 4226054213 is appearing in all the entries in our map.usr file and map.ggSid coming up when we do an ACL. No Re-ACL of Domain Users.A rollback removes it so we know it is the ODM tool that is adding it -
Cause
This is normal when the option 'Preserve Rollback Metadata In ACLs' (screenshot attached) is selected in your ReACL profile. It is selected by default.That extra section/digits added are simply the' target security principals', temporarily addedAs part of the ReACL, we added a metadata foot print by using an invalid SID, it gets removed during cleanup. This is needed for Rollback and Cleanup.We added that and it will be okay since it is an invalid SID and would not authenticate anything. -
Resolution
Eventually the SID will be removed as part of the cleanup. -
Attachments
