XP-Security Question!

[Ryan]

I've got another mission for you guys. In Windows XP, when
you can in Explorer and right-click on any folder, go to
properties and then click on security. There is this one
account starting with "S-1-5-21...". Who put it there,
where does it come from and how do I get rid of it. Let's
see if you can solve this one

Ryan

 

[Ronnie Vernon MVP]

I've got another mission for you guys. In Windows XP, when
you can in Explorer and right-click on any folder, go to
properties and then click on security. There is this one
account starting with "S-1-5-21...". Who put it there,
where does it come from and how do I get rid of it. Let's
see if you can solve this one

Ryan

The alphanumeric number you are seeing is the Security Identifier. (SID)
A data structure of variable length that identifies user, group, and
computer accounts. Every account is issued a unique SID when the account is
first created. Internal processes in Windows refer to an account's SID
rather than the account's user or group name. These contain your rights and
permissions.

It is displayed in the properties of the security tab when the account name
can't be looked up, for example when the account has been deleted or when
the machine used to belong to a domain but does not any more.

I would simply leave it there.
--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

 

[Alan]

I found more related to the "RECYCLER" folder when I did a Google search using "XP recycler directory."

At URL http://groups.yahoo.com/group/xxcopy/message/2546 I came up with this:

"I was not clear enough in my original message and since then I have
probed further into my situation. Allow me, please, to explain
further and tell you what I now believe:

There is a "RECYCLER" directory/folder on all three partitions of my
primary HDD (C:, my boot drive, F: and G:; all NTFS) and on the two
partitions (H: FAT32 and I: NTFS) of my firewire/1394 external hard
drive. These directories are all hidden system directories with one
and only one identical subfolder (name=S-1-5-21-1538417202-315636210-
488748980-1003). Each of these subfolders contains a the contents
(or more correctly the pointers to the contents ) of Recycle Bin.
When one displays the contents of any of these identical subfolders
from within Explorer the display is the standard "name, original
location, date deleted" recycle bin format when in details view; not
the "name, ext, size,type, date, etc." format with which Explorer
displays details in other folders.

Now I am a long time PowerDesk file manager user (I seldom ever use
Explorer)and that Power Desk displays these "RECYCLER" subfolders in
its standard details view format (e.g., no date deleted column). Not
being too observant for some time I thought this was all discardable
stuff generated by some obscure "clean up" application. I noted (and
still note) that is is easy to delete these folders and hoped that I
could mangage to "clone" from c: to g: without copying that folder.
Whenever and whatever I tried, however, resulted in the dreaded
RECYCLER folder appearing on the previously clean and pristine drive
g:.

The bottom line seems to be that Windows XP insists that the recycle
bin be on each logical hard drive and when XP notices that one is
missing it creates a "RECYCLER" folder in the root directory of
the "clean" drive....at least that is how it works here."

Alan

 

[Alex Nichol]

I believe the "S-1-5-21" directories are sub-directories of the RECYCLER
folder (not Recycle Bin).

RECYCLER is something that Norton uses. If you open up the S-1-5-21
directory, you should see the files that are sitting in your Recycle Bin.

On an NTFS disk, which allows file protection by user, the recycle Bin
has the name RECYCLER< and it contains a separate folder for each user,
to hold the files *he* deletes. This is named with the SID of his
account, as one of the uses Ronnie describes

 

[Anonymous]

I've got another mission for you guys. In Windows XP, when
you can in Explorer and right-click on any folder, go to
properties and then click on security. There is this one
account starting with "S-1-5-21...". Who put it there,
where does it come from and how do I get rid of it. Let's
see if you can solve this one

Ryan

It is an account name.
If you format your computer and install a new system, the old account remains
associated with the security settings.
You just don't see the friendly name "myoldaccount" but the windows reference
S-*-*.
Hope this helps