I have just migrated my 2 DC's from 2012r2 to 2019 and during the migration, the AD auto-generated new groups (enterprise key admins, key admins) and assigned permissions to these groups at the root of the domain, for some reason the enterprise key admins group didn't apply permissions correctly and now it's shown an orphaned SID- enterprise key admins - at the root of the domain.
help me to apply the permissions on enterprise key admins group