# Orphaned User Accounts

> Why orphaned local user accounts are a security risk when you use local group validation, and what to do about them.

Source: https://docs.capaone.com/capaone/troubleshooting/orphaned-user-accounts/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

:::caution[Security risk]
Because orphaned user accounts are not owned by anyone and consequently are not monitored, attackers often use them to install and distribute malicious software without being exposed.
:::

## Problem

If you are using local group validation and have specified a local group containing an orphaned user account and the domain controller is unavailable, it will some times take longer to validate elevation requests.

![Slow elevation request validation caused by an orphaned account](/attachments/capaone/461df3fa-707b-47df-8d27-8d3b7f6fa352.png)

***AdminOnDemand.log***

![AdminOnDemand.log showing the delayed validation](/attachments/capaone/a255e60f-8b22-4452-9ab9-ba4814ac9ac6.png)

## Solution

### Detect and delete orphaned user accounts

Orphaned user accounts are accounts that no longer exist. Orphaned user accounts typically appear when an Active Directory account has been added to a local group and the Active Directory account is deleted afterwards.

![Orphaned user account shown as an unresolved SID in a local group](/attachments/capaone/fdaf1763-5d81-4779-92ec-9d0a9186396c.png)

## Enumeration

Enumerating accounts in a group that contain orphaned user accounts often takes a considerable amount of time, especially when the domain controller is unavailable.

It can take up to 120 seconds to enumerate a group that contain orphaned user accounts.

In the example below, the domain controller is unavailable and the local group “LocalGroup1” does not contain orphaned user accounts, but the local group “LocalGroup2” does.

![LocalGroup2 containing an orphaned account while the domain controller is unavailable](/attachments/capaone/78e74d18-f039-4272-a775-d71703a1a004.png)

As a result, the PowerShell cmdlet “Get-LocalGroupMember” does not work when enumerating a group containing orphaned user accounts.

![Get-LocalGroupMember failing to enumerate a group with an orphaned account](/attachments/capaone/7531d391-0e74-49b1-96b8-68aa6b081298.png)