Solved unknown account

[meebers]

Started looking at some file properties, mainly excel, and noticed under the security tab, Group or users names, there is an unknown account showing up that starts with "s-1-5-21 48xxxxxxx - xxxxxxxxxx-...." I did not fill out all the numbers in case it means something?? Have any idea what this might mean. Hope it is normal. Looks like the "guy" has a red "?" on his back.

 

[Parman]

Its the SAM. (I believe that's what its called I'm a little out of it ATM).
Its you see it like that because the name associated with it was probably removed from the computer.

 

[cottonball]

@Parman,

Had to think about it myself, and you probably mean SID = User's Security Identifier

@meebers,

To find out what SID belongs to a User name:

Open a Command Prompt by pressing the Windows key and the R key at the same time.
In the Run prompt, type: cmd

Now, right-click the following command inside the quote box, and select Copy:

wmic useraccount get name,sid

Right-click by the blinking cursor of the Command Prompt, and select: Paste
Press: Enter

A list appears with each User account in Windows, listed by User name and followed by its SID.


~~~~
To explain a little further...what is showing looks like red-circled 'x', which, like Parman said, the name associated with it was probably removed from the computer. The deleted account was granted access to the object you are checking.

When the account is deleted the system does not remove the access control list entry.
The red-circled 'x' appears because the system can no longer resolve the SID to an account name, since the account no longer exists.

 

[Britton30]

Read this for some insight. What is this (Account Unknown) SID ?

 

[Parman]

I knew that would be wrong. thanks guys.

 

[cottonball]

@Parman

You have the explanation right!

 

[meebers]

Wow, that makes me feel better...I think. Checked mine, the Unknown was 1004 and as you can see in the attachment, 0, 7 and 9 are currently in use. That means that I did something with 1001, 1002, 1003, 1005, 1006 and 1008 previously, heavens knows what. (they sequence up by 1 from 1000)? I am going to keep reading the articles a little more before I attempt to remove the unknown. Tx...

 

[cottonball]

meebers,

Those last 4 numbers, are called a Relative ID (RID):
Security Identifier - Wikipedia, the free encyclopedia

RID:
Relative ID - Wikipedia, the free encyclopedia

...and on, and on...