Safety Identifier (SID) Historical past is a helpful mechanism in Lively Listing (AD) migrations. It permits customers and teams in a brand new area to retain entry to assets that also depend on permissions from the outdated area. Nonetheless, as soon as migrations are accomplished, these historic SIDs can grow to be muddle, posing each safety and administrative challenges. Whereas it’s greatest to take away pointless SID Historical past as quickly as you’re achieved migrating, many environments skip this step. Over time, decommissioned or damaged trusts make cleanup harder, and area objects can accrue so many aged entries that you just lose monitor of what’s nonetheless required.
💡 Why Clear Up SID Historical past?
- Safety – Outdated SID Historical past entries can grow to be an assault vector. If an exterior or stale SID continues to be lurking, it might theoretically be used to realize unauthorized entry.
- Administrative Overhead – Carrying in depth historic SIDs creates noise in AD. Directors would possibly spend further time digging by means of or troubleshooting outdated references.
- Compliance – Sure rules or inner insurance policies encourage or require minimal exterior references in manufacturing domains.
When left unattended for years, stale SID Historical past can balloon into 1000’s of entries. At that time, a methodical, managed cleanup is required to keep away from disruptions.To deal with these challenges, CleanupMonster now affords a brand new operate, Invoke-ADSIDHistoryCleanup, that gives a structured strategy to take away undesirable SID Historical past:
- Focused or Bulk Removing – You’ll be able to choose particular domains, organizational models, and even particular area SIDs to incorporate or exclude. This fine-grained management ensures you solely take away what you propose.
- Security Limits – Cleanup might be restricted to a sure variety of objects (e.g., 2 per run) or a sure variety of SID entries (e.g., 5 whole) per execution. This manner, if one thing goes mistaken, the impression is contained.
- Reporting and Logging – The operate creates HTML and XML experiences that allow you to overview modifications earlier than, throughout, and after they occur. This contains which objects had been modified, what SID values had been eliminated, and potential errors.
- WhatIf Mode – Testing your plan is a should. By utilizing -WhatIf, you may simulate the elimination course of to see precisely what can be deleted with out making any modifications.
By working the method in small increments, you may monitor how eradicating SID Historical past impacts person entry. If points come up, you may restore or alter your method earlier than persevering with.
💡 Reporting Key to Success
Cleansing up SID Historical past is fairly straightforward, nevertheless the important thing to doing it correctly is to have a correct reporting and logging course of that may assist discover out the foundation reason behind person points that absolutely will present up when you begin eradicating 1000’s of SID Historical past data. That is why CleanupMonster offers built-in HTML reporting and an e-mail physique ready for this lengthy cleanup course of. It follows the same sample to the cleanup of computer systems and offers:
- Total report about SID Historical past in a forest together with all data, tabs with particular area SIDs, and extra
- Present Run Tab – accommodates final run details about which objects had been affected by the cleanup.
- Historic Knowledge Tab – accommodates historical past of a number of runs over time
- Logs – every step is logged to file, however for the usefulness of the report, it is also included in HTML for simple entry
The above picture reveals an summary of the present SID historical past within the forest. It tries to summarize knowledge primarily based on inner SID Historical past (forest strikes), Exterior SID Historical past (trusts), and Unknown SID historical past (deleted trusts, and many others). The picture under reveals the elimination of the SID Historical past, which reveals the SID from which the item was eliminated and the way the item appeared earlier than and after the elimination occurred. It accommodates details about the motion, when it occurred, and whether or not it was profitable.
The historical past tab accommodates details about all earlier runs of SID Historical past Cleanup and what occurred. Needless to say the XML file should be current, because the historical past is saved internally. In any other case, the historical past will solely preserve present knowledge.
The final tab, as proven within the picture, accommodates logs from the script run. Whereas the script writes the log to the file, it additionally shows its content material if the HTML report is used inside TheDashboard.
Lastly, each time the script runs, it prepares an HTML physique for an e-mail to be despatched exterior the script scope. As soon as the script runs, you should utilize the module’s HTML physique or create your personal with obtainable knowledge.
Now that what you are getting, it is time to see how difficult the setup for the above is. Proper?
💡 Working the script
Step one is to put in the CleanupMonster moduleInstall-Module CleanupMonster -Power -VerboseThen, it is a matter of working a single operate, Invoke-ADSIDHistoryCleanup. Beneath is an instance of how one can schedule a sluggish, managed cleanup over time. Please discover using particular SIDHistoryDomains, RemoveLimits, and different settings.
# Put together splat
$invokeADSIDHistoryCleanupSplat = @{
Verbose = $true
WhatIf = $true
IncludeSIDHistoryDomain = @(
# 'S-1-5-21-3661168273-3802070955-2987026695'
'S-1-5-21-853615985-2870445339-3163598659'
)
RemoveLimitSID = 1
RemoveLimitObject = 2
SafetyADLimit = 1
ShowHTML = $true
On-line = $true
LogPath = "$PSScriptRootProcessedSIDHistory.log"
ReportPath = "$PSScriptRootProcessedSIDHistory.html"
DataStorePath = "$PSScriptRootProcessedSIDHistory.xml"
}
# Run the script
$Output = Invoke-ADSIDHistoryCleanup @invokeADSIDHistoryCleanupSplat
$Output | Format-Desk -AutoSize
# Lets ship an e-mail
$EmailBody = $Output.EmailBody
# Ship e-mail with Microsoft Graph and utilizing Mailozaurr module
Join-MgGraph -Scopes 'Mail.Ship' -NoWelcome
Ship-EmailMessage -To 'przemyslaw.klys@take a look at.pl' -From 'przemyslaw.klys@take a look at.pl' -MgGraphRequest -Topic "Automated SID Cleanup Report" -Physique $EmailBody -Precedence Low -Verbose
When you run the script, an HTML report is generated, and you too can ship an e-mail with pre-prepared content material. Do not forget that the operate has a number of different parameters that assist delete solely what you need. Please DO NOT RUN the script with out first testing it out on TEST ENVIRONMENT and understanding what occurs and the way it impacts the atmosphere! This operate is DANGEROUS! Here is a assist file for the operate that cleans up SID Historical past on a world stage.
NAME
Invoke-ADSIDHistoryCleanup
SYNOPSIS
Cleans up SID historical past entries in Lively Listing primarily based on varied filtering standards.
SYNTAX
Invoke-ADSIDHistoryCleanup [[-Forest] ] [[-IncludeDomains] ] [[-ExcludeDomains] ] [[-IncludeOrganizationalUnit]
] [[-ExcludeOrganizationalUnit] ] [[-IncludeSIDHistoryDomain] ] [[-ExcludeSIDHistoryDomain] ]
[[-RemoveLimitSID] ] [[-RemoveLimitObject] ] [[-IncludeType] ] [[-ExcludeType] ] [[-ReportPath] ]
[[-DataStorePath] ] [-ReportOnly] [[-LogPath] ] [[-LogMaximum] ] [-LogShowTime] [[-LogTimeFormat] ] [-Suppress]
[-ShowHTML] [-Online] [-DisabledOnly] [[-SafetyADLimit] ] [-DontWriteToEventLog] [-WhatIf] [-Confirm] []
DESCRIPTION
This operate identifies and removes SID historical past entries from AD objects primarily based on specified filters.
It could goal inner domains (identical forest), exterior domains (trusted), or unknown domains.
The operate permits for detailed reporting earlier than making any modifications.
PARAMETERS
-Forest
The identify of the forest to course of. If not specified, makes use of the present forest.
-IncludeDomains
An array of domains to incorporate within the cleanup course of.
-ExcludeDomains
An array of domains to exclude from the cleanup course of.
-IncludeOrganizationalUnit
An array of organizational models to incorporate within the cleanup course of.
-ExcludeOrganizationalUnit
An array of organizational models to exclude from the cleanup course of.
-IncludeSIDHistoryDomain
An array of area SIDs to incorporate when cleansing up SID historical past.
-ExcludeSIDHistoryDomain
An array of area SIDs to exclude when cleansing up SID historical past.
-RemoveLimitSID
Limits the full variety of SID historical past entries to take away.
-RemoveLimitObject
Limits the full variety of objects to course of for SID historical past elimination. Defaults to 1 to stop unintentional mass deletions.
-IncludeType
Specifies which sorts of SID historical past to incorporate: 'Inside', 'Exterior', or 'Unknown'.
Defaults to all three varieties if not specified.
-ExcludeType
Specifies which sorts of SID historical past to exclude: 'Inside', 'Exterior', or 'Unknown'.
-ReportPath
The trail the place the HTML report needs to be saved. Used with the -Report parameter.
-DataStorePath
Path to the XML file used to retailer processed SID historical past entries.
-ReportOnly []
If specified, solely generates a report with out making any modifications.
-LogPath
The trail to the log file to jot down.
-LogMaximum
The utmost variety of log information to maintain.
-LogShowTime []
If specified, contains the time within the log entries.
-LogTimeFormat
The format to make use of for the time within the log entries.
-Suppress []
Suppresses the output of the operate and solely returns the abstract data.
-ShowHTML []
If specified, reveals the HTML report within the default browser.
-On-line []
If specified, makes use of on-line assets in HTML report (CSS/JS is loaded from CDN). In any other case native assets are used (greater HTML file).
-DisabledOnly []
Solely processes objects which might be disabled.
-SafetyADLimit
Stops processing if the variety of objects with SID historical past in AD is lower than the desired restrict.
-DontWriteToEventLog []
-WhatIf []
Exhibits what would occur if the operate runs. The SID historical past entries aren't really eliminated.
-Affirm []
This cmdlet helps the widespread parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For extra data, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
-------------------------- EXAMPLE 1 --------------------------
PS C:>Invoke-ADSIDHistoryCleanup -Forest "contoso.com" -IncludeType "Exterior" -ReportOnly -ReportPath "C:TempSIDHistoryReport.html" -WhatIf
Generates a report of exterior SID historical past entries within the contoso.com forest with out making any modifications.
-------------------------- EXAMPLE 2 --------------------------
PS C:>Invoke-ADSIDHistoryCleanup -IncludeDomains "domain1.native" -IncludeType "Inside" -RemoveLimitSID 2 -WhatIf
Removes as much as 2 inner SID historical past entries from objects in domain1.native.
-------------------------- EXAMPLE 3 --------------------------
PS C:>Invoke-ADSIDHistoryCleanup -ExcludeSIDHistoryDomain "S-1-5-21-1234567890-1234567890-1234567890" -WhatIf -RemoveLimitObject 2
Exhibits what SID historical past entries can be eliminated whereas excluding entries from the desired area SID. Limits the variety of objects to course of to 2.
-------------------------- EXAMPLE 4 --------------------------
PS C:># Put together splat
$invokeADSIDHistoryCleanupSplat = @{
Verbose = $true
WhatIf = $true
IncludeSIDHistoryDomain = @(
'S-1-5-21-3661168273-3802070955-2987026695'
'S-1-5-21-853615985-2870445339-3163598659'
)
IncludeType="Exterior"
RemoveLimitSID = 1
RemoveLimitObject = 2
SafetyADLimit = 1
ShowHTML = $true
On-line = $true
DisabledOnly = $true
#ReportOnly = $true
LogPath = "C:TempProcessedSIDHistory.log"
ReportPath = "$PSScriptRootProcessedSIDHistory.html"
DataStorePath = "$PSScriptRootProcessedSIDHistory.xml"
}
# Run the script
$Output = Invoke-ADSIDHistoryCleanup @invokeADSIDHistoryCleanupSplat
$Output | Format-Desk -AutoSize
# Lets ship an e-mail
$EmailBody = $Output.EmailBody
Join-MgGraph -Scopes 'Mail.Ship' -NoWelcome
Ship-EmailMessage -To 'przemyslaw.klys@take a look at.pl' -From 'przemyslaw.klys@take a look at.pl' -MgGraphRequest -Topic "Automated SID Cleanup Report" -Physique
$EmailBody -Precedence Low -Verbose
REMARKS
To see the examples, kind: "get-help Invoke-ADSIDHistoryCleanup -examples".
For extra data, kind: "get-help Invoke-ADSIDHistoryCleanup -detailed".
For technical data, kind: "get-help Invoke-ADSIDHistoryCleanup -full".
Many organizations choose to not take away all SID Historical past without delay. With small, incremental runs, you are able to do the next:
- Schedule the cleanup (e.g., each day, weekly)
- Restrict the variety of objects or SIDs every time
- Evaluate the report and logs
- Affirm that customers can nonetheless entry important assets
- Improve or lower cleanup velocity as confidence grows
This method helps construct belief within the course of and reduces the danger of widespread entry points.
💡 Warnings and Finest Practices
- All the time take a look at with WhatIf – Confirm the objects and SID values focused earlier than any actual deletions.
- Use RemoveLimitObject and RemoveLimitSID to ensure a restricted variety of SIDs are eliminated/will get affected (default one object being processed)
- Backup – Guarantee you could have AD backups or methods to revert modifications if you happen to uncover sure SID Historical past was nonetheless required.
- Communication—Inform your assist desk or related groups that SID Historical past entries are being eliminated to allow them to shortly troubleshoot entry points.
- Desire Early Cleanup – When you’re in the midst of a website migration, don’t postpone SID Historical past cleanup indefinitely. Doing it when trusts are nonetheless obtainable is vastly simpler than ready years.
💡 Conclusion
Cleansing up SID Historical past is a vital however typically forgotten step. By leveraging CleanupMonster’s Invoke-ADSIDHistoryCleanup, you could have a safer path to regularly take away stale SID entries, preserve a cleaner Lively Listing, and strengthen safety. Check completely, proceed incrementally, and protect your logs for audit and troubleshooting.
For extra data on how SID Historical past works, you may overview Microsoft’s documentation on SID Historical past. The brand new function is a part of the CleanupMonster module, which handles duties like cleansing up unused laptop accounts. Take a look at the present weblog posts on CleanupMonster for particulars about its different functionalities.Whereas CleanupMonster is a one-shot answer to SID Historical past Removing, do not forget that you must know what you are doing earlier than even beginning this course of. It is there for a purpose, and eradicating it, as proposed by CleanupMonster, has its penalties. This answer is principally constructed when it is nearly not possible to inform what’s what anymore, and cleansing it up appropriately is solely not possible. Moreover, please don’t run this module if you happen to’re solely after the SID Historical past report. Whereas the module has a ReportOnly change, working a devoted reporting command is healthier. You will get the SID historical past report from the ADEssentials PowerShell module.
# Set up module or replace if nessecary
Set up-Module ADEssentials -Power -Verbose
# Run the report
$Object = Present-WinADSIDHistory -On-line -PassThru
$Object
The instructions above ship very comparable output to the one proven within the screenshots above with out the danger of working the cleanup software. It is the popular methodology of creating when you have an issue that this software tries to unravel!
