Security Compliance

Remove ACE does not remove unresolved SIDs in directories in Access Rights Manager

This article explains an issue where the Remove ACE action in the Unresolved SIDs in directories analysis appears to complete but does not remove any ACEs, and how to resolve it by configuring the proper change accounts for file servers and Active Directory in SolarWinds Access Rights Manager (ARM).

First published date

3/3/2026 12:14 PM

Last published date

3/3/2026 12:14 PM

Overview

In ARM, the Unresolved SIDs in directories analysis lists directories that contain ACEs for accounts that no longer exist in Active Directory.

From this view, administrators can select affected entries and use Remove ACE to clean up those permissions on the file system.

In the affected scenario, Remove ACE is scheduled and shown as executed in the ARM client, but the unresolved SID ACEs remain unchanged on the directories.

Product section

Access Rights Manager

Cause

When removing ACEs (including unresolved SIDs), ARM uses the change configuration credentials for the file server and the Active Directory change account from the AD scan configuration.

If these change accounts are not correctly configured for the relevant resources, ARM cannot apply the permission changes required by Remove ACE.

Resolution

Resolution 1 – Configure the file server change credential

  1. Open the ARM Configuration client.
  2. Go to Change Configuration > File Server.
  3. Select the affected file server.
  4. Under Basic Settings, assign a credential (service account) that has sufficient NTFS rights on the affected paths to modify and remove ACEs (read, write, and permission changes as required by your environment).
  5. Save the configuration.
  6. In the ARM rich client, go to Analysis > Directories > Unresolved SIDs in directories, recalculate if needed, select the entries, and click Remove ACE again.

 

Resolution 2 – Configure the Active Directory change account

  1. In the ARM Configuration client, open Scan and edit the relevant Active Directory scan configuration.
  2. Under “Changes will be done using account”, assign a service account that has appropriate permissions in AD and on the file servers to perform the required permission changes and deletions.
  3. Save the configuration, then rerun the Active Directory and relevant file server scans so ARM uses the updated change accounts.
  4. Retry Remove ACE from Unresolved SIDs in directories and confirm that the unresolved SID ACEs are now removed.

For the standard procedure to work with unresolved SIDs and Remove ACE, see the Unresolved SIDs sections in the ARM Administrator Guide (Unresolved SIDs and Remove ACE).