Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Unknown Auditing entity

26 Sep 2011   #1

Windows 7 Pro 64-bit Service Pack 1
Unknown Auditing entity

There is an unknown (to me) entry in my C: drive Security/Advanced/Auditing properties box (see the attached image - the entry in question is the first entry, the S-1..... entry).

Does anyone know what this entry is and if I can get rid of it?


Attached Images
Unknown Auditing entity-unknown.jpg 
My System SpecsSystem Spec
26 Sep 2011   #2
Microsoft MVP

Windows 7 Ultimate 32bit SP1

What does it say if you click 'edit' on the entry? It could be your profile/identity
My System SpecsSystem Spec
26 Sep 2011   #3

Windows 7 Pro 64-bit Service Pack 1

All it says is in the attached. There is no other information to display. Makes me wonder if this is a virus/trojan/malware, etc, since it has full control over everything.

Attached Images
Unknown Auditing entity-unknown-2.jpg 
My System SpecsSystem Spec

27 Sep 2011   #4
Microsoft MVP

Windows 7 Ult. x64

Mmm...that looks like a classic Recycler reference. Is this a work PC, or home PC?

Usually, the Recycler folders are Read-Only....but there was a Recycler virus going around a while that correct Jacee?

Found this, but not sure of its applicability :

Remove Recycler Virus - What it is and How to Conduct a Recycler Virus Removal

My System SpecsSystem Spec
27 Sep 2011   #5

Windows 7 Pro 64-bit Service Pack 1

This is a home PC - Win 7 64-bit Pro. I've run IOBit, MalwareBytes, and NIS 2012 and all come up clean.
My System SpecsSystem Spec
27 Sep 2011   #6

MS Windows 7 Ultimate 64-bit SP1

This is a Security identifier for one of your previous user which you/system might have created in earlier windows on this disk and you might have upgraded this hard drive with new OS (like from winXP to Win 7).

The old user name is deleted with the upgrade but the NTFS file system retains the SID of the previous users in the form (S-1-5-21-3894458719-3405545046-3428966848-1000) in the Access Control Lists (NTFS permissions) for all the old retained folders and files.

Open the Regedit and expand the HKey_Users and you will find entries of keys with such names.

As these are the Security identifiers of old users which does not exist now, it is safe to delete them from the NTFS permissions for all folders.
My System SpecsSystem Spec

 Unknown Auditing entity

Thread Tools

Similar help and support threads
Thread Forum
Software Auditing
I am trying to find an application that can do an audit of my PC and tell me what applications I have installed and all of their serial and license keys. I know these applications exist cause my company uses one for when we reimage a machine. I am in essence going to be reimaging my machine to...
Several log entries of event 4624 in security auditing
I have several of these logs reported followed shortly by an event 4634. What the heck is this. Is someone logging onto my computer when I get on it? Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/21/2012 9:23:56 PM Event ID: 4624 Task...
Performance & Maintenance
How to create easier reporting for Windows auditing?
Hello, My dad has all his important files in a folder named "IMP" in E: in Windows 7. I've set auditing object access failure and enabled auditing on the IMP folder and denied read access and delete folder for all other users. Everything is working fine and I can check the event viewer...
General Discussion
Windows Recovery disk shows operating system: Unknown on (Unknown)
I've been trolling the forums here for a while. Lots of great info but now I actually have an issue where I need some assistance. :D When I was booting one day last week I got a nasty BSOD when Windows was trying to load. Then on the next reboot Windows 7 said it couldn't load and needed to do...
BSOD Help and Support
Window minimized with unknown entity capturing mousepointer When I play bfbc2 (fullscreen) this comes up and minimizes the game. I really dont know what it is or what it does. I cant seem to get rid of it. I dont really have any unkonwn programs or services on my system.
Memory Usage Auditing.......
Source - Memory Usage Auditing for .NET Applications
Performance & Maintenance

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 16:03.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App