Unknown SID

[Ben]

Hi,

I've been looking through our disk quota on the server, and found that there
are 2 users with over 1gb of data. However the quota entries are just SIDs,
it maybe that someone has deleted the users, before sorting their files out.
Is there anyway to determine which user it used to be, or what files belong
to that sid?

 

[Arek Iskra [MVP]]

Probably you are right - these are leftovers after deleted user accounts.
Tools like SIDwalker or AccessEnum should help you to investigate:

SIDwalker:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techref/en-us/sidwalker.asp

AccessEnum:
http://www.sysinternals.com/ntw2k/source/accessenum.shtml

 

[Steven L Umbach]

You might want to check the file dates on files in those folders to see if they are
current or not. Finding the user may not be possible [at least easily] if the
accounts have been disabled. You could try using the dumpsec tool from SomarSoft to
display current user sids [local or domain] to try and match up. --- Steve

http://www.somarsoft.com/