Remove SID History Entries –

You can clear the sIDHistory attribute with the ActiveDirectory PowerShell module. You need Domain Admin rights, or delegated write access to sIDHistory.

Before you remove anything: SID History usually exists because the accounts were migrated from another domain. If file shares, NTFS permissions, Exchange mailboxes, or apps still grant access through the old SIDs, users will lose that access once the history is removed. Re-permission those resources to the current SIDs first, using a tool such as ADMT’s security translation or SubInACL/icacls. Removal is effectively permanent, since putting SID History back requires migration tooling.

1. Find users that have SID History

powershell

Import-Module ActiveDirectory

Get-ADUser -LDAPFilter "(sIDHistory=*)" -Properties sIDHistory |
    Select-Object SamAccountName, @{n='SIDHistory';e={$_.sIDHistory -join '; '}}

2. Save a record before changing anything

powershell

Get-ADUser -LDAPFilter "(sIDHistory=*)" -Properties sIDHistory |
    Select-Object SamAccountName, DistinguishedName, @{n='SIDHistory';e={$_.sIDHistory -join ';'}} |
    Export-Csv C:\Temp\SIDHistory_Backup.csv -NoTypeInformation

3. Remove SID History from a single user

powershell

$user = Get-ADUser jdoe -Properties sIDHistory
foreach ($sid in $user.sIDHistory) {
    Set-ADUser $user -Remove @{sIDHistory = $sid.Value}
}

4. Remove SID History from all users

Run it once with -WhatIf to see what would change. Then remove -WhatIf to apply the changes.

powershell

Get-ADUser -LDAPFilter "(sIDHistory=*)" -Properties sIDHistory | ForEach-Object {
    $u = $_
    foreach ($sid in $u.sIDHistory) {
        Set-ADUser $u -Remove @{sIDHistory = $sid.Value} -WhatIf
        Write-Host "Removed $($sid.Value) from $($u.SamAccountName)"
    }
}

To clear all values in one call instead, use Set-ADUser $u -Clear sIDHistory.

5. Verify

powershell

Get-ADUser -LDAPFilter "(sIDHistory=*)" | Measure-Object

The count should be 0.

Notes

• Groups and computers: these can carry SID History too. Use the same approach with Get-ADGroup / Set-ADGroup or Get-ADComputer / Set-ADComputer.
• Token size: users may need to log off and back on before their access tokens reflect the change.
• Cleanup afterwards: if the old domain trust no longer exists, consider disabling SID History on the trust with netdom trust /enablesidhistory:no, or keeping SID filtering enabled. This is a good security hardening step, because SID History is a known abuse vector for privilege escalation.