Security tab displays "Unknown Account (S-1-5-21-#'s)

[Guest]

When I right-click on some drives/folders/files then click on
properties\security I get some entries under "groups and user names" that say
Adiministrator, User, System, etc. which are normal entries. But sometimes
there are entries that say Account Unknown (S-1-5-21-...#'s) which I can't
figure out. Are the entries normal, where do they come from, can they be
deleted without negative effects? Can anyone explain these entries? Have I
given enough info for an explanation? I'm not versed in
permissions/ownership, etc. but can follow directions fairly well. I am using
WinXP Pro SP2. Thanks.

jmike

 

[Guest]

The situation described is occurring on a standalone personal PC not
connected to any network. I can remove these permissions. Can anyone tell me
if there any potential impact to my system beyond the simple removal of these
permissions? In other words, will their removal have any kind of
domino-effect regarding system instability or other malfunctions? Thanks.

 

[Ramesh, MS-MVP]

The orphaned SIDs can be removed safely. However, ensure that you're not
removing the default / reserved SIDs.

Well-known security identifiers in Windows operating systems:
http://support.microsoft.com/kb/243330

Well-known SIDs:
http://msdn.microsoft.com/library/d...y/en-us/secauthz/security/well_known_sids.asp

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


The situation described is occurring on a standalone personal PC not
connected to any network. I can remove these permissions. Can anyone tell me
if there any potential impact to my system beyond the simple removal of
these
permissions? In other words, will their removal have any kind of
domino-effect regarding system instability or other malfunctions? Thanks.

 

[Guest]

Ramesh,

Thanks for responding. I have decided to remove the SID's mentioned, some at
a time, after doing a backup. So far there have been no noticable
ill-effects.

Do you have any thoughts on the possible source of these "Unknown Account"
SIDs?

Could they have been left over from a previous incarnation (reformatting) of
the C:\ drive where some files (or backed up parts) of the original C:\, with
the associated SIDs, were reused on (restored to) the new incarnation of C:\?

Thanks,

jmike

The orphaned SIDs can be removed safely. However, ensure that you're not
removing the default / reserved SIDs.

Well-known security identifiers in Windows operating systems:
http://support.microsoft.com/kb/243330

Well-known SIDs:
http://msdn.microsoft.com/library/d...y/en-us/secauthz/security/well_known_sids.asp

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


The situation described is occurring on a standalone personal PC not
connected to any network. I can remove these permissions. Can anyone tell me
if there any potential impact to my system beyond the simple removal of
these
permissions? In other words, will their removal have any kind of
domino-effect regarding system instability or other malfunctions? Thanks.

When I right-click on some drives/folders/files then click on
properties\security I get some entries under "groups and user names" that
say
Adiministrator, User, System, etc. which are normal entries. But sometimes
there are entries that say Account Unknown (S-1-5-21-...#'s) which I can't
figure out. Are the entries normal, where do they come from, can they be
deleted without negative effects? Can anyone explain these entries? Have I
given enough info for an explanation? I'm not versed in
permissions/ownership, etc. but can follow directions fairly well. I am
using
WinXP Pro SP2. Thanks.

jmike

 

[Ramesh, MS-MVP]

Do you have any thoughts on the possible source of these "Unknown
1. I have two installations of Windows XP in different partitions (C: and
G. When I assign permissions to a folder when in C:\ Windows, the same SID
shows as "unknown" when you boot into your 2nd Windows installation.

2. Your machine is removed from a Domain recently?

3. The unknown SID is a result of deleting a user account.


--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


Ramesh,

Thanks for responding. I have decided to remove the SID's mentioned, some at
a time, after doing a backup. So far there have been no noticable
ill-effects.

Do you have any thoughts on the possible source of these "Unknown Account"
SIDs?

Could they have been left over from a previous incarnation (reformatting) of
the C:\ drive where some files (or backed up parts) of the original C:\,
with
the associated SIDs, were reused on (restored to) the new incarnation of
C:\?

Thanks,

jmike

 

[Guest]

Ramesh,

1. I have only one installation of Windows XP
2. I have never had this PC on a domain
3. Sounds like this could be the source of the orphaned SIDs. I'll just
continue to delete them, unless you have other suggestions. Thanks again.

1. I have two installations of Windows XP in different partitions (C: and
G. When I assign permissions to a folder when in C:\ Windows, the same SID
shows as "unknown" when you boot into your 2nd Windows installation.

2. Your machine is removed from a Domain recently?

3. The unknown SID is a result of deleting a user account.


--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


Ramesh,

Thanks for responding. I have decided to remove the SID's mentioned, some at
a time, after doing a backup. So far there have been no noticable
ill-effects.

Do you have any thoughts on the possible source of these "Unknown Account"
SIDs?

Could they have been left over from a previous incarnation (reformatting) of
the C:\ drive where some files (or backed up parts) of the original C:\,
with
the associated SIDs, were reused on (restored to) the new incarnation of
C:\?

Thanks,

jmike

 

[beb]

Well you can go to here, if you are comfortable with the registry,
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, where you
should see each profile sid and their information including each
ProfileImagePath

Ramesh,

1. I have only one installation of Windows XP
2. I have never had this PC on a domain
3. Sounds like this could be the source of the orphaned SIDs. I'll just
continue to delete them, unless you have other suggestions. Thanks again.

Do you have any thoughts on the possible source of these "Unknown
Account" SIDs?

1. I have two installations of Windows XP in different partitions (C: and
G. When I assign permissions to a folder when in C:\ Windows, the same
SID
shows as "unknown" when you boot into your 2nd Windows installation.

2. Your machine is removed from a Domain recently?

3. The unknown SID is a result of deleting a user account.


--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


Ramesh,

Thanks for responding. I have decided to remove the SID's mentioned, some
at
a time, after doing a backup. So far there have been no noticable
ill-effects.

Do you have any thoughts on the possible source of these "Unknown
Account"
SIDs?

Could they have been left over from a previous incarnation (reformatting)
of
the C:\ drive where some files (or backed up parts) of the original C:\,
with
the associated SIDs, were reused on (restored to) the new incarnation of
C:\?

Thanks,

jmike