"Unknow User Account" makes me nervous

[Conan Kelly]

Hello all,

I've noticed an unknow user account in the "Security" tab in the
"Properties" dialogue box of my files/folders. This makes me nervous.

It may have showed up about the time I started a new job (within the last 3
months--have had the computer for 3+ years) in a small office. I brought my
personal laptop in to use until they were able to get a machine ordered for
me. I had to join their domain. Since then, I've reverted back to
"Workgroup" networking, but the account is still there.

I can post/email a screen print for anyone who wants to see it. (I don't
know if we are allowed to attach files to posts in these NG's--please let me
know!)

Is this supposed to be there? If not, can it be removed?

Thanks for any help anyone can provide,

Conan Kelly

 

[Kevin]

If you have a screenshot post it on a personal web page. Don't post it
here. Have the IT staff in your office take a look at the laptop and they
should be able to get rid of that entry for you.

 

[Conan Kelly]

Kevin,

Thanks for the info. You can check out my screenshot here:
http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg


This small business consists of 10 people total, (5 locally in this office I
work in). The guy who is mainly in charge of the systems does not come from
a network admin background. And considering that I'm a computer student,
him and I are the IT Dept. The other option is calling the outside
networking company (but at however many 100's of dollars per hour, that is
not going to be my first choice). I'm not even sure that it did come from
joining my company's domain.

Thanks for any help you can provide,

Conan

 

[Leythos]

Kevin,

Thanks for the info. You can check out my screenshot here:
http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg

Any account that starts with an S and a bunch of numbers is a
disconnected account - you see this when the local computer can't reach
the domain to get the accounts name resolved properly.

If you setup a couple computers in a domain, then change the domain name
or remove the computer from the domain, so that the domain controller is
no longer accessible, you will see accounts like that.

You may also see accounts like that if you've recovered a corrupted
local OS.

Unless you are using a domain that you have disconnected temporarily,
it's most likely safe to delete it.

One thing - before you delete it - you're not using EFS on that folder
are you?

 

[Conan Kelly]

Leythos, Kevin, and MTENet,

Thank you for all of your feed back. It is very much appreciated.

Leythos, to answer your question: No, I'm not using EFS on any of my
files/folders.

Now how do I go about making sure I've removed it? It didn't show up
in Computer Managment>System Tools>Local Users & Groups>Users and it
didn't show up in HKEY_USERS. When I when to Share
Properties>Security Tab>, I selected Unknown Account and clicked
Remove. It took along time to do its thing (I think it may have
removed it from the other shares, but I did not verify).

Once again, thanks for everyone's help,

Conan Kelly

 

[Leythos]

Leythos, Kevin, and MTENet,

Thank you for all of your feed back. It is very much appreciated.

Leythos, to answer your question: No, I'm not using EFS on any of my
files/folders.

Now how do I go about making sure I've removed it? It didn't show up
in Computer Managment>System Tools>Local Users & Groups>Users and it
didn't show up in HKEY_USERS. When I when to Share
Properties>Security Tab>, I selected Unknown Account and clicked
Remove. It took along time to do its thing (I think it may have
removed it from the other shares, but I did not verify).

You will have to remove it where-ever you find it.

 

[Nepatsfan]

Run the registry editor and navigate to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList

See if the SID number associated with that user account is
listed. This may give you a clue as to what the original
account was.

To delete this account you can try the following:

In Control Panel, open System Properites. On the Advanced page,
click on the Settings button in the User Profiles section. See
if there's an entry for "Account Unknown". Select that entry to
hightlight the account and hit the delete button.

Good luck

Nepatsfan

 

[Conan Kelly]

Thanks again to everyone. Your help is much appreciated.

Conan Kelly

 

[-Karl]

Jeez, you only should need to look in the User Manager. remove it
there. Then open Users & Groups in the MMC and look at the groups for
any odd accounts.

Then look in your Documents & Settings for any profiles that you don't
want and delete them. Removing an account from User Manager does not
delete their profile. There is a way to do both but it's inside the
System Properties (undere advanced --> Users settings ??? or about
there.)

You don't need to hack the registry unless you are really paranoid.