Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Unknown Auditing entity

26 Sep 2011   #1

Windows 7 Pro 64-bit Service Pack 1
Unknown Auditing entity

There is an unknown (to me) entry in my C: drive Security/Advanced/Auditing properties box (see the attached image - the entry in question is the first entry, the S-1..... entry).

Does anyone know what this entry is and if I can get rid of it?


Attached Images
Unknown Auditing entity-unknown.jpg 
My System SpecsSystem Spec
26 Sep 2011   #2
Microsoft MVP

Windows 7 Ultimate 32bit SP1

What does it say if you click 'edit' on the entry? It could be your profile/identity
My System SpecsSystem Spec
26 Sep 2011   #3

Windows 7 Pro 64-bit Service Pack 1

All it says is in the attached. There is no other information to display. Makes me wonder if this is a virus/trojan/malware, etc, since it has full control over everything.

Attached Images
Unknown Auditing entity-unknown-2.jpg 
My System SpecsSystem Spec

27 Sep 2011   #4
Microsoft MVP

Windows 7 Ult. x64

Mmm...that looks like a classic Recycler reference. Is this a work PC, or home PC?

Usually, the Recycler folders are Read-Only....but there was a Recycler virus going around a while that correct Jacee?

Found this, but not sure of its applicability :

Remove Recycler Virus - What it is and How to Conduct a Recycler Virus Removal

My System SpecsSystem Spec
27 Sep 2011   #5

Windows 7 Pro 64-bit Service Pack 1

This is a home PC - Win 7 64-bit Pro. I've run IOBit, MalwareBytes, and NIS 2012 and all come up clean.
My System SpecsSystem Spec
27 Sep 2011   #6

MS Windows 7 Ultimate 64-bit SP1

This is a Security identifier for one of your previous user which you/system might have created in earlier windows on this disk and you might have upgraded this hard drive with new OS (like from winXP to Win 7).

The old user name is deleted with the upgrade but the NTFS file system retains the SID of the previous users in the form (S-1-5-21-3894458719-3405545046-3428966848-1000) in the Access Control Lists (NTFS permissions) for all the old retained folders and files.

Open the Regedit and expand the HKey_Users and you will find entries of keys with such names.

As these are the Security identifiers of old users which does not exist now, it is safe to delete them from the NTFS permissions for all folders.
My System SpecsSystem Spec

 Unknown Auditing entity

Thread Tools

Similar help and support threads
Thread Forum
Looking for free computer auditing software
I need a free pc auditing software that gets the hardware, software information of the computer and the log file can be save as a .csv file. Thank you
How do I enable Auditing?
I've just come across MBSA when sorting out a missing IE11 update and am impressed with it. One item on the reports says: NeitherLogon Success nor Logon Failure auditing are enabled. Enable auditing and turnon auditing for specific events such as logon and logoff. Be sure to monitoryour...
System Security
Software Auditing
I am trying to find an application that can do an audit of my PC and tell me what applications I have installed and all of their serial and license keys. I know these applications exist cause my company uses one for when we reimage a machine. I am in essence going to be reimaging my machine to...
Window minimized with unknown entity capturing mousepointer When I play bfbc2 (fullscreen) this comes up and minimizes the game. I really dont know what it is or what it does. I cant seem to get rid of it. I dont really have any unkonwn programs or services on my system.
Memory Usage Auditing.......
Source - Memory Usage Auditing for .NET Applications
Performance & Maintenance

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 16:00.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App