Active Directory DNS _ldap SRV record owner is an Unknown account

Question

While performing an audit of our AD DNS environment, we found numerous SRV records having an "Account Unknown" owner. For example, the _ldap SRV records shown below for our 4 domain controllers all show the same "Account Unknown" SID (5623) as the owner of the records. Does anybody know what the default owner should be for these records?

Answer 1

Hello Shaunm001,

Thank you for posting in Q&A forum.

Here are the default permission entries (I mean I have never changed it) in my lab.

For "Inherited from" entries, I have only 4 entries:
Domain Admins
Everyone
enterprise domain controllers
System

It seems the "Account Unknown" SID (5623) as the owner of the records" is the owner by who changed and the "Account Unknown" SID (5623)" permission entry is added by one in the past (not the default one permission entry).

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

This should be set to SYSTEM. It's anyone's guess how this happened, but fortunately that's easy to fix

---

hth

Marcin

Answer 3

Thanks everyone, is it the case for all SRV records under _msdcs.domain.local zone that the owner should be SYSTEM? For example, there are additional _ldap records under _tcp.gc._msdcs.domain.local that also have the same "Unknown" account as owner: