ACL Cleaner

Remove orphaned / dead SIDs from file server ACLs

The administration of permissions has now reached a considerable complexity. Quickly sneak in mistakes. One mistake, however, which leads to consequences only later, is the direct assignment of rights to users or user groups from the AD. If you delete these users or groups from the Active Directory without first removing the entries from the ACLs, the ACLs will leave behind unresolvable (orphaned) SIDs. The same is true of the owner SIDs. The amount of these entries can quickly grow to a few thousand.

There is now the “ACL Cleaner”, which cleanly removes all orphaned entries from the ACLs.

Your benefits

Easiest removal of all orphaned SIDs from ACL and Owner
no elaborate scripts necessary
safe, transparent process
Support for different file server systems

Detailed information

How much is the ACL-Cleaner?

How is licensed?

The ACL Cleaner is licensed per file server to be cleaned up.

How does the purchase process?

If you are interested in the ACL-Cleaner, the following procedure is usual:

• You request an offer for the required number of file servers via the offer form or in person.
• You send / fax us an order on business paper. This job must contain the names of the servers on which the ACL Cleaner is to be used.
• We will create a license file for the ACL-Cleaner containing the specified servers and send you a download link for the latest version of the ACL-Cleaner.
• Billing is for companies and public institutions on account with ten-day payment. Credit card payments are not possible.

How does the ACL-Cleaner work?

The engine of the ACL Cleaner specifically handles the ACLs that contain orphaned SIDs. This targeted cleaning is based on previous scans. These scans (templates) can either be done by the ACL-Cleaner itself or supplied by other applications. One application that can currently deliver this is 8MAN.

The analysis and the adjustment are based on Shares.

ACL Cleaner for 8MAN

All companies that use 8MAN have the advantage that 8MAN has a feature that makes all orphaned / dead SIDs visible. These can be exported in a CSV report from 8MAN. The "ACL-Cleaner" from aikux.com is a new tool that is able to clean up the identified ACLs. To do this, the export is passed to the ACL Cleaner, which now cleans all ACLs in turn. After the next scan of 8MAN then in the report for orphaned / dead SIDs no entries should be found. The "ACL-Cleaner" by aikux.com can save you many hours of work and also a complex scripting.

System requirements for the ACL Cleaner

On the server side

• Microsoft Fileserver from 2003, NetApp Filer, EMC (other CIFs based systems)

Client Side (Location of ACL Cleaner Installation):

• .net Framework 3.5 SP1 full installation
• Windows Server 2003 SP2 or higher
• Windows XP SP3 or higher
• RAM: 2 GB
• CPU: Current processor (at least 1 core)

Technical details about the ACL Cleaner: http://help.migraven.com/acl-cleaner/

How are orphaned / dead SIDs created?

To control access permissions to file server resources, we recommend that you use domain groups and domain accounts. These can be entered directly into the ACL of the directories of the file server. A domain account or a domain group consists of a one-to-one security ID. Since this SID is bad for us humans to manage, you give the account also a name. Windows works internally with the SID - we work with the name. If you now want to assign a user or a group an authorization, then we select the appropriate account and assign it to the permissions on the file server. Something else happens in the system: At the system level, the ACL does not record the name but the SID.

Now, if an account is deleted from the Active Directory, without the previously removed the entry from the ACL, this SID can not be resolved at the next viewing the security settings. There is no object in the AD with it in reference. So this entry can and should be removed as well.

Why should orphaned SIDs be removed?

Quite simple: On the one hand avoids performance losses, a malicious manipulation of the SID history with the possibility of uncontrolled rights inheritance can be excluded and last but not least, it pleased the auditor, even if there is order.

I want to know more!

• In our blog: KnowHow for assigning file server permissions
• The aikux authorization workshop

Have you already removed your orphaned SIDs with the ACL Cleaner? We would be pleased if you share your experience with the comment function. Positive feedback is just as welcome as criticism and suggestions for improvement.

Sincerely, Your aikux.com Team