Explorer owners column shows SID instead of name

[James P. H. Fuller]

Hi! I recently reset the Explorer default view on my PC to always display the
Owners column. Having done that, I now see what I expected to see: lots of
system stuff owned by Administrators, lots of user stuff owned by
NIALL\721jpf (the computer is NIALL and I'm 721jpf. That's the only logon I
ever use.)

But I also see files and folders all over the machine for which the
displayed user is somebody's SID instead of the friendly name. And it isn't
721jpf's SID either (I checked that from a cmd window while logged on as
721jpf, using >whoami /user /sid) it's a different SID. And a lot of these
files are ones I definitely remember creating as 721jpf.

Can some knowledgeable person tell me...

1) Is there a way to determine just who
S-1-5-21-839522115-838170752-682003330-1022 is?

2) Is there a good clean-up strategy? I'd rather not try to find each of
these files/folders individually and take ownership one by one! There's 1.1
TB storage here. And

3) In general, what might have happened to cause this?

Thanks very much!

James Fuller

P.S. And a hat tip in advance to anybody who understands NTFS at this depth.
Oh yeah, this is XP SP3. If I should post more information, just tell me what.

 

[John John (MVP)]

Take a look at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList and see if the user is showing there.

John

 

[John John (MVP)]

Question 2: You can take ownership en masse of all files and folders on
the storage drive/array. Right click on the root folder of the drive
and do the usual to get to the Security tab and the option to take
ownership of the files and select to "Replace owner on subcontainers and
objects".

If you have several valid owners on files on the drive and if you only
want to replace the owner on the specific SID use the SubInAcl tool,
available from the Microsoft site.

John

PS: Question 3 I have no idea, these phantom SIDs are usually present
if the drive was mounted and used on another Windows installation.

 

[Andrew McLaren]

Hi James,

Just a comment/question, in addition to the good advice in John John's
replies ... is the machine joined to an Active Directory domain? Such as
a corporate network?

SID's for local accounts and certain "well-known" accounts (eg
Administrator, Guest, etc) are created and stored locally. You can find
them under ProfileList in the Registry, as John John says.

SIDs for domain accounts are stored on the Domain Controllers. To
translate teh SID into a friendly name for display purposes, an app
(such as Explorer in this case) needs to make an RPC call to the Domain
Controller. If all the DCs are offline, or there is a network problem,
you can see raw SIDs instead of friendly names. I have certainly seen
this in the past! However, once the workstation can access Active
Directory on the DC again, the SIDs will go back to appearing as
friendly names; and life is good again.

Hope it helsp a bit,

Andrew

 

[James P. H. Fuller]

john john:

If you have several valid owners on files on the drive and
if you only want to replace the owner on the specific SID
use the SubInAcl tool, available from the Microsoft site.

My daughter owns lots of music and anime files on her network share. I'll
check out subinacl but not do anything drastic until I've read about it some
and made a new C: image (all the data drives get nightly backups, so they're
OK. The SIDs in the owner column are ugly but they aren't really hurting any
functionality and I'm wary of making things worse with an ill-understood fix.
But I've heard of subinacl and ought to know how to use it (I have an MCSE
but my job is PACS administrator in a hospital and I haven't ever worked as a
domain admin, so there's lots of stuff I don't know.) Thanks for the tip. I'm
counting that as question 2 down.

Take a look at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList and see if the user is showing
there

Well, that's another third of the mystery. The SID belongs to said daughter,
who used to log in as kelly on her own PC and had accounts with matching IDs
and passwords on the other two PCs we have here to make workgroup-style
network sharing a little smoother. She recently made herself a new account
with a different username, and then started getting "You don't have
permission to access this network resource. Go yell at your administrator"
messages. The administrator would be dad, so I made her new accounts all
'round with the new ID. And deleted user kelly on my PC which, though I
didn't see it happen, is bound to be the moment all these files stopped
belonging to kelly and started belonging to our friend
S-1-5-21-839522115-838170752-682003330-1022.

these phantom SIDs are usually present if the drive was mounted
and used on another Windows installation.

John, I think you've gone three for three. Not exactly a different Win
installation (in fact I made great efforts to keep the win installation the
same, as I'll describe,) but the drive was once the boot drive of a
completely different PC. I got lots of new hardware including a new
motherboard and processor but the drive was only about 18 months old then and
the windows install was pretty elaborate and I'm lazy so (not really
expecting it to work but having nothing to lose, also just for the L of it)
before taking the old machine down for the last time I went to device
manager, displayed hidden devices, and deleted everything in sight. And then
tried moving the drive to the new PC and booting from it to see how much of
the new hardware it could recognize and install drivers for. It complained
bitterly and blue-screened multiple times but eventually it at least gave me
safe mode. From there after several passes with the registry cleaner in
CCleaner.exe--which seems to me to really hit the sweet spot between not
doing much of anything and cutting too deep--and some google-aided manual
registry fixes it gave me a boot to XP standard mode which lasted a good
twenty minutes before croaking. After a bit more cleanup and a couple of sfc
/scannow passes and a few drivers that had to be downloaded from vendor sites
(but not many, basically just for the new chipset, new graphics card and new
soundcard) it seemed almost, y'know, useable. That was xmas of 2006 and I'm
still using it and it's now (especially since installing SP3) as clean and
stable as it was before its harrowing experience.

I like telling this tale to folks who diss on windows. But I still encounter
the occasional oddness left over from the abuse I gave it then and I feel
sure something I did resulted in kelly owning lots of my files. Strongest
evidence is that all the files and folders now owned by
S-1-5-21-839522115-838170752-682003330-1022 show a creation date from before
the great switchover.


Andrew:

If all the DCs are offline, or there is a network problem,
you can see raw SIDs instead of friendly names. I have
certainly seen this in the past! However, once the workstation
can access Active Directory on the DC again, the SIDs will
go back to appearing as friendly names; and life is good again.

Yeah, I've seen that much also. At work. Where I work for radiology, not
I.T., and I consider it part of my job to give my radiologists what they say
they need for best patient care, rather than enforcing I.T. policies that
were basically made for secretaries. Among these is a workaround for making
all the MDs local admins of their own reading stations (example of the need:
their report dictation software, from a Very Big Name I'll call D*ctaPh*ne,
insists on writing to the registry and often throws session-ending tantrums
if it can't.) Well, it was a near-panic moment after the I first time I tried
slipping their domain IDs into the local admin group and then rebooted off
the domain to do other stuff, and saw all the doctors' login names change to
SIDs on all their profile files. But, as you say, just reconnect to the
domain and all those SIDs turn back to normal friendly usernames. (If you
call DR1479 friendly, anuway. At least it's friendlier than
S-1-5-21-839522115-838170752-682003330-1022!)

Thanks very much to both of you!