Phantom Accounts

[Steve UK]

When editing permission entries in safe mode i have found that there are
several accounts listed in the security dialogue boxes that vary but do not
refer to any account on the computer. for instance, the list may say;

steve
administrators
everyone

which is fine but then another entry listed as
unknown account 5-1-2 3465345-45547454-345634-3346456-

this has occurred since i did a clean install of xp. does anyone know what
they refer to?

thanks.

 

[Quaoar]

When editing permission entries in safe mode i have found that there
are several accounts listed in the security dialogue boxes that vary
but do not refer to any account on the computer. for instance, the
list may say;

steve
administrators
everyone

which is fine but then another entry listed as
unknown account 5-1-2 3465345-45547454-345634-3346456-

this has occurred since i did a clean install of xp. does anyone know
what they refer to?

thanks.

Is .Net Framework installed? If so, it might be related since it is a
user, and in safe mode who knows what would show up since its
driver/app/? is probably not loading but could remain listed. You might
do a regedit search using part of that string and see what if anything
pops up.

Q

 

[Wesley Vogel]

Steve;

The alpha/numerical layout doesn't look right.
[[unknown account 5-1-2 3465345-45547454-345634-3346456-]]

Look here:
Well-Known Security Identifiers
http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnc_sid_cids.asp

 

[Steve UK]

no, i do not have .net framework installed. i have 'advanced networking pack
for windows' but i have not downloaded .net framework from ms updates.

 

[Steve UK]

i'm not surprised that it doesn't look right because i made it up!

it was something like that when i looked but i didn't have the exact info
when i posted.

Steve;

The alpha/numerical layout doesn't look right.
[[unknown account 5-1-2 3465345-45547454-345634-3346456-]]

Look here:
Well-Known Security Identifiers
http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnc_sid_cids.asp

--
Hope this helps. Let us know.
Wes

In

When editing permission entries in safe mode i have found that there
are several accounts listed in the security dialogue boxes that vary
but do not refer to any account on the computer. for instance, the
list may say;

steve
administrators
everyone

which is fine but then another entry listed as
unknown account 5-1-2 3465345-45547454-345634-3346456-

this has occurred since i did a clean install of xp. does anyone know
what they refer to?

thanks.

 

[Steve UK]

also wesley i am using xp home. the article that you point out seems to
refer to professional edition??

Steve;

The alpha/numerical layout doesn't look right.
[[unknown account 5-1-2 3465345-45547454-345634-3346456-]]

Look here:
Well-Known Security Identifiers
http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnc_sid_cids.asp

--
Hope this helps. Let us know.
Wes

In

When editing permission entries in safe mode i have found that there
are several accounts listed in the security dialogue boxes that vary
but do not refer to any account on the computer. for instance, the
list may say;

steve
administrators
everyone

which is fine but then another entry listed as
unknown account 5-1-2 3465345-45547454-345634-3346456-

this has occurred since i did a clean install of xp. does anyone know
what they refer to?

thanks.

 

[Wesley Vogel]

Steve;

A lot of the stuff will be the same.
Pro will have extra items.
Home will not have Power Users for example.

There are some known Unknown Accounts.
S-1-5-31-549 = Server Operators
S-1-5-31-550 = Printer Operators.
-----------------
I had one when I had Home, in the Registry
Start | Run | regedit | OK
Edit | Permissions
Permissions for HKEY_CURRENT_CONFIG
Account Unknown (S-1-5-32-547)
------------
See if you have a scesetup.log.
C:\WINDOWS\security\logs\ scesetup.log

User rights

Mine lists:
S-1-5-32-546 = Guests
S-1-5-32-19 = LocalService
S-1-5-20 = NetworkService
S-1-5-32-544 = Administrators
S-1-5-32-551 = Backup Operators
S-1-5-32-547 = Power Users
S-1-5-32-545 = Users
S-1-1-0 = Null Authority
S-1-5-32-555 = Remote Desktop Users
S-1-5-21-1708537768-1580436667-1202660629-501 = I don't have a clue!

--
Hope this helps. Let us know.
Wes

In

also wesley i am using xp home. the article that you point out seems
to refer to professional edition??

Steve;

The alpha/numerical layout doesn't look right.
[[unknown account 5-1-2 3465345-45547454-345634-3346456-]]

Look here:
Well-Known Security Identifiers

http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnc_sid_cids.asp

--
Hope this helps. Let us know.
Wes

In

 

[Steve UK]

.. thanks for that, but i don't understand why they are needed at all, can i
deleted them or change permissions in them or should i just leave them alone
and pretend that they don't exist?

ta.

Steve;

A lot of the stuff will be the same.
Pro will have extra items.
Home will not have Power Users for example.

There are some known Unknown Accounts.
S-1-5-31-549 = Server Operators
S-1-5-31-550 = Printer Operators.
-----------------
I had one when I had Home, in the Registry
Start | Run | regedit | OK
Edit | Permissions
Permissions for HKEY_CURRENT_CONFIG
Account Unknown (S-1-5-32-547)
------------
See if you have a scesetup.log.
C:\WINDOWS\security\logs\ scesetup.log

User rights

Mine lists:
S-1-5-32-546 = Guests
S-1-5-32-19 = LocalService
S-1-5-20 = NetworkService
S-1-5-32-544 = Administrators
S-1-5-32-551 = Backup Operators
S-1-5-32-547 = Power Users
S-1-5-32-545 = Users
S-1-1-0 = Null Authority
S-1-5-32-555 = Remote Desktop Users
S-1-5-21-1708537768-1580436667-1202660629-501 = I don't have a clue!

--
Hope this helps. Let us know.
Wes

In

also wesley i am using xp home. the article that you point out seems
to refer to professional edition??

Steve;

The alpha/numerical layout doesn't look right.
[[unknown account 5-1-2 3465345-45547454-345634-3346456-]]

Look here:
Well-Known Security Identifiers

http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnc_sid_cids.asp

 

[Wesley Vogel]

Steve;

I'm not 100% sure which accounts you're referring to.

Administrator = Leave enabled.
Guest = Enable or disable.
Help assistant = Enable or disable.
Support = Enable or disable.
You = Obvious
SYSTEM = Don't mess with this one.

--
Hope this helps. Let us know.
Wes

In

. thanks for that, but i don't understand why they are needed at all,
can i deleted them or change permissions in them or should i just
leave them alone and pretend that they don't exist?

ta.

Steve;

A lot of the stuff will be the same.
Pro will have extra items.
Home will not have Power Users for example.

There are some known Unknown Accounts.
S-1-5-31-549 = Server Operators
S-1-5-31-550 = Printer Operators.
-----------------
I had one when I had Home, in the Registry
Start | Run | regedit | OK
Edit | Permissions
Permissions for HKEY_CURRENT_CONFIG
Account Unknown (S-1-5-32-547)
------------
See if you have a scesetup.log.
C:\WINDOWS\security\logs\ scesetup.log

User rights

Mine lists:
S-1-5-32-546 = Guests
S-1-5-32-19 = LocalService
S-1-5-20 = NetworkService
S-1-5-32-544 = Administrators
S-1-5-32-551 = Backup Operators
S-1-5-32-547 = Power Users
S-1-5-32-545 = Users
S-1-1-0 = Null Authority
S-1-5-32-555 = Remote Desktop Users
S-1-5-21-1708537768-1580436667-1202660629-501 = I don't have a clue!

--
Hope this helps. Let us know.
Wes

In

also wesley i am using xp home. the article that you point out seems
to refer to professional edition??


Steve;

The alpha/numerical layout doesn't look right.
[[unknown account 5-1-2 3465345-45547454-345634-3346456-]]

Look here:
Well-Known Security Identifiers

http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnc_sid_cids.asp

 

[Steve UK]

well, my users are listed in the security options (in safe mode) for editing
permission entries, but so are these mysterious accounts which bear no
resemblance to any user on my computer

Steve;

I'm not 100% sure which accounts you're referring to.

Administrator = Leave enabled.
Guest = Enable or disable.
Help assistant = Enable or disable.
Support = Enable or disable.
You = Obvious
SYSTEM = Don't mess with this one.

--
Hope this helps. Let us know.
Wes

In

. thanks for that, but i don't understand why they are needed at all,
can i deleted them or change permissions in them or should i just
leave them alone and pretend that they don't exist?

ta.

Steve;

A lot of the stuff will be the same.
Pro will have extra items.
Home will not have Power Users for example.

There are some known Unknown Accounts.
S-1-5-31-549 = Server Operators
S-1-5-31-550 = Printer Operators.
-----------------
I had one when I had Home, in the Registry
Start | Run | regedit | OK
Edit | Permissions
Permissions for HKEY_CURRENT_CONFIG
Account Unknown (S-1-5-32-547)
------------
See if you have a scesetup.log.
C:\WINDOWS\security\logs\ scesetup.log

User rights

Mine lists:
S-1-5-32-546 = Guests
S-1-5-32-19 = LocalService
S-1-5-20 = NetworkService
S-1-5-32-544 = Administrators
S-1-5-32-551 = Backup Operators
S-1-5-32-547 = Power Users
S-1-5-32-545 = Users
S-1-1-0 = Null Authority
S-1-5-32-555 = Remote Desktop Users
S-1-5-21-1708537768-1580436667-1202660629-501 = I don't have a clue!

--
Hope this helps. Let us know.
Wes

In Steve UK <[email protected]> hunted and pecked:
also wesley i am using xp home. the article that you point out seems
to refer to professional edition??


Steve;

The alpha/numerical layout doesn't look right.
[[unknown account 5-1-2 3465345-45547454-345634-3346456-]]

Look here:
Well-Known Security Identifiers

http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnc_sid_cids.asp

 

[Wesley Vogel]

Editing where?
File & Folder permissions?
Registry?
User Accounts?
Network Connections?
Scheduled Tasks?
Account Policies?
Local Policies?
Event Log?
System Services?

Start | Settings | Control Panel | User Accounts ??
You
Guest
dotNET??
Adminstrator

Right click a File or Folder | Properties | Security tab ??
You
SYSTEM
Administrators
Guest

Right click My Computer | Manage |
[+] Local Users and Groups
Users
Groups

Post back with where you're talking about.
And list the Users.
NT AUTHORITY?
ASP.NET?
Bill G.?
Bob?
Sue?
Who?

Are these mysterious Accounts secret?
Do they have a name?
A number?

--
Hope this helps. Let us know.
Wes

In

well, my users are listed in the security options (in safe mode) for
editing permission entries, but so are these mysterious accounts
which bear no resemblance to any user on my computer

Steve;

I'm not 100% sure which accounts you're referring to.

Administrator = Leave enabled.
Guest = Enable or disable.
Help assistant = Enable or disable.
Support = Enable or disable.
You = Obvious
SYSTEM = Don't mess with this one.

--
Hope this helps. Let us know.
Wes

In

. thanks for that, but i don't understand why they are needed at
all, can i deleted them or change permissions in them or should i
just leave them alone and pretend that they don't exist?

ta.


Steve;

A lot of the stuff will be the same.
Pro will have extra items.
Home will not have Power Users for example.

There are some known Unknown Accounts.
S-1-5-31-549 = Server Operators
S-1-5-31-550 = Printer Operators.
-----------------
I had one when I had Home, in the Registry
Start | Run | regedit | OK
Edit | Permissions
Permissions for HKEY_CURRENT_CONFIG
Account Unknown (S-1-5-32-547)
------------
See if you have a scesetup.log.
C:\WINDOWS\security\logs\ scesetup.log

User rights

Mine lists:
S-1-5-32-546 = Guests
S-1-5-32-19 = LocalService
S-1-5-20 = NetworkService
S-1-5-32-544 = Administrators
S-1-5-32-551 = Backup Operators
S-1-5-32-547 = Power Users
S-1-5-32-545 = Users
S-1-1-0 = Null Authority
S-1-5-32-555 = Remote Desktop Users
S-1-5-21-1708537768-1580436667-1202660629-501 = I don't have a
clue!

--
Hope this helps. Let us know.
Wes

In Steve UK <[email protected]> hunted and pecked:
also wesley i am using xp home. the article that you point out
seems to refer to professional edition??


Steve;

The alpha/numerical layout doesn't look right.
[[unknown account 5-1-2 3465345-45547454-345634-3346456-]]

Look here:
Well-Known Security Identifiers

http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prnc_sid_cids.asp