Does anyone know of a snap-in for the MMC that can decode SID errors? I have annoying message on the event viewer I would to know what it is so I can track it down. Thank you.MRA A+ CNST CFOI CCNP

Not sure what errors you are referring to, but something like ADFIND maybe useful. I would ask this in a Windows Forum: http://social.technet.microsoft.com/Forums/en/category/windowsserver/

I'm not aware of any snap ins, what's the error?James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

I am getting an event id 6006 Source MSEXchane SACL Watcher "SACL Watcher servicelet found that the SeSecurityPrivilege privilege is removed from account " followed by the SID number.MRA A+ CNST CFOI CCNP

Check out adfind and see if that helps: http://blog.joeware.net/2007/02/06/797/

Please refer the suggestion from 1337-wizard in this thread for troubleshootingPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

OK That is the problem I am having. I found that the Exchange server group is missing. S-1-5-21-683310180-2785665884-1636211786-17126. This is the error I am getting "SACL Watcher servicelet found that the SeSecurityPrivilege privilege is removed from account S-1-5-21-683310180-2785665884-1636211786-17126." I will find if this missing from manage audit policy MRA A+ CNST CFOI CCNP

OK I found Exchange server group is still in the Default domain policy under "Manage auditing and Security Log" I will keep digging. I will still keep digging. MRA A+ CNST CFOI CCNP

I miss spoke myself. The exchange servers group is already to the manage and security policy under the Default Domain Policy. So I am good there. I have done the command GPupdate /force on the mailbox server. That did not help. The error still came back. I am wondering if I should just remove it, do a force gpupdate and then readd the exchange servers. I am not sure if this is needed information, however, I still have a 2003 exchange box floating out there. It is not doing anything right now. No Mailbox, no distro list, no SMTP traffic flowing. It is pretty much dead. You guys think I should shut it down?MRA A+ CNST CFOI CCNP