Summary

Find files where the owner is an unresolved or orphaned SID.

Details

When a user account is deleted from Active Directory, files owned by that account remain in the file system tagged with the raw SID instead of a resolvable account name. These orphaned ownerships often indicate stale data, abandoned home directories, or files that need re-assignment before the account’s history is fully cleaned up.

This query lists every file in a scan target whose owner_display_name is still a raw SID literal (matching the pattern S-%). Change the scan_target line in the WHERE clause to match your environment.

Code

SELECT
    sd.identity_system,
    sd.scan_target,
    sd.fullpath,
    sd.size AS size,
    srs.byte_string(sd.size) AS size_string,
    sd.create_time,
    sd.modify_time,
    sd.access_time,
    sd.owner_display_name
FROM
    srs.current_fs_scandata_ad AS sd
WHERE
    (sd.scan_target = '\\ad.cctec.org\Shares\Home') AND
    (sd.owner_display_name LIKE ('S-%') Escape '#')