AD-DACL-15: Unresolved SID count should be investigated
| ID | AD-DACL-15 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Unresolved SIDs in DACLs often indicate deleted users or groups, stale migration artifacts, or incomplete cleanup.
- Stale delegation detection: Old ACEs can remain after identities are removed
- Operational hygiene: Orphaned SID references make permissions harder to review and audit
- Migration validation: Unresolved SIDs can reveal accounts that were not fully remapped or retired
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Investigate unresolved SID ACEs and determine whether they can be removed
- Validate that deprovisioning and migration processes clean up obsolete permissions
- Review privileged containers first, where stale ACEs can cause confusion during incident response
How the Test Works
Section titled “How the Test Works”This test reads $adState.DaclEntries and looks for entries whose IdentityReference starts with S-1-5-21, which commonly indicates a SID that did not resolve to a friendly name.
Related Tests
Section titled “Related Tests”Test-MtAdDaclUnresolvedSidDetails- Lists unresolved SID references by objectTest-MtAdDaclDistinctIdentityCount- Counts distinct identities present in ACEsTest-MtAdDaclIdentityAceDistribution- Shows ACE distribution across identities
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.