Archived from groups: microsoft.public.win2000.security (
More info?)
Doesn't the RID of 1007 mean it was the seventh user account ever created on
the domain? That might help narrow it down.
Ray
"Roger Abell" <mvpNOSpam@asu.edu> wrote in message
news:%2357IGMEXFHA.3840@tk2msftngp13.phx.gbl...
> "Matt Gibson" <mattg@blueedgetech.ca> wrote in message
> news:%23cPPI9DXFHA.2128@TK2MSFTNGP15.phx.gbl...
> > Or that account was part of a domain that has since been left.
> >
> > Matt Gibson - GSEC
>
> Yep, or a domain that is unresolvable due to DNS, network,
> or even just a stopped Tcp/Ip NetBios helper service, etc..
> But usually then, as with a disjoined domain membership,
> many principals will be shown as SIDs, etc., there may be
> some delays, etc..
> I still think deleted principals is the most common though.
> --
> Roger
>
> >
> > "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> > news:eVlvIzDXFHA.228@TK2MSFTNGP12.phx.gbl...
> > > The most common reason, if other principals are being
> > > shown with their display names, is an account or group
> > > that has been deleted.
> > >
> > > --
> > > Roger Abell
> > > Microsoft MVP (Windows Security)
> > > MCSE (W2k3,W2k,Nt4) MCDBA
> > > "jonh" <jonh@discussions.microsoft.com> wrote in message
> > > news:512FE541-4C97-4EB4-8839-69EE046C2733@microsoft.com...
> > >> Hello,
> > >>
> > >> can anyone suggest why we are discovering this SID in the permissions
> on
> > >> a
> > >> variety of folders on a Windows 2000 Pro PC?
> > >>
> > >> Thanks
> > >
> > >
> >
> >
>
>
Facebook
Twitter
Instagram