"Unknow User Account" makes me nervous

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

Hello all,

I've noticed an unknow user account in the "Security" tab in the
"Properties" dialogue box of my files/folders. This makes me nervous.

It may have showed up about the time I started a new job (within the last 3
months--have had the computer for 3+ years) in a small office. I brought my
personal laptop in to use until they were able to get a machine ordered for
me. I had to join their domain. Since then, I've reverted back to
"Workgroup" networking, but the account is still there.

I can post/email a screen print for anyone who wants to see it. (I don't
know if we are allowed to attach files to posts in these NG's--please let me
know!)

Is this supposed to be there? If not, can it be removed?

Thanks for any help anyone can provide,

Conan Kelly
8 answers Last reply
More about unknow user account makes nervous
  1. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

    If you have a screenshot post it on a personal web page. Don't post it
    here. Have the IT staff in your office take a look at the laptop and they
    should be able to get rid of that entry for you.

    "Conan Kelly" <CTBarbarin at msn dot com> wrote in message
    news:ewGByU$sFHA.284@TK2MSFTNGP14.phx.gbl...
    > Hello all,
    >
    > I've noticed an unknow user account in the "Security" tab in the
    > "Properties" dialogue box of my files/folders. This makes me nervous.
    >
    > It may have showed up about the time I started a new job (within the last
    > 3 months--have had the computer for 3+ years) in a small office. I
    > brought my personal laptop in to use until they were able to get a machine
    > ordered for me. I had to join their domain. Since then, I've reverted
    > back to "Workgroup" networking, but the account is still there.
    >
    > I can post/email a screen print for anyone who wants to see it. (I don't
    > know if we are allowed to attach files to posts in these NG's--please let
    > me know!)
    >
    > Is this supposed to be there? If not, can it be removed?
    >
    > Thanks for any help anyone can provide,
    >
    > Conan Kelly
    >
  2. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

    Kevin,

    Thanks for the info. You can check out my screenshot here:
    http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg


    This small business consists of 10 people total, (5 locally in this office I
    work in). The guy who is mainly in charge of the systems does not come from
    a network admin background. And considering that I'm a computer student,
    him and I are the IT Dept. The other option is calling the outside
    networking company (but at however many 100's of dollars per hour, that is
    not going to be my first choice). I'm not even sure that it did come from
    joining my company's domain.

    Thanks for any help you can provide,

    Conan


    "Kevin" <webman6@hotmail.com> wrote in message
    news:%23IcxgkCtFHA.2948@TK2MSFTNGP10.phx.gbl...
    > If you have a screenshot post it on a personal web page. Don't post it
    > here. Have the IT staff in your office take a look at the laptop and they
    > should be able to get rid of that entry for you.
    >
  3. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

    In article <e5YyCfDtFHA.3264@TK2MSFTNGP12.phx.gbl>, "Conan Kelly"
    <CTBarbarin at msn dot com> says...
    > Kevin,
    >
    > Thanks for the info. You can check out my screenshot here:
    > http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg

    Any account that starts with an S and a bunch of numbers is a
    disconnected account - you see this when the local computer can't reach
    the domain to get the accounts name resolved properly.

    If you setup a couple computers in a domain, then change the domain name
    or remove the computer from the domain, so that the domain controller is
    no longer accessible, you will see accounts like that.

    You may also see accounts like that if you've recovered a corrupted
    local OS.

    Unless you are using a domain that you have disconnected temporarily,
    it's most likely safe to delete it.

    One thing - before you delete it - you're not using EFS on that folder
    are you?

    --

    spam999free@rrohio.com
    remove 999 in order to email me
  4. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

    Leythos, Kevin, and MTENet,

    Thank you for all of your feed back. It is very much appreciated.

    Leythos, to answer your question: No, I'm not using EFS on any of my
    files/folders.

    Now how do I go about making sure I've removed it? It didn't show up
    in Computer Managment>System Tools>Local Users & Groups>Users and it
    didn't show up in HKEY_USERS. When I when to Share
    Properties>Security Tab>, I selected Unknown Account and clicked
    Remove. It took along time to do its thing (I think it may have
    removed it from the other shares, but I did not verify).

    Once again, thanks for everyone's help,

    Conan Kelly


    "Leythos" <void@nowhere.lan> wrote in message
    news:MPG.1d89e2d1b60e2dd7989f78@news-server.columbus.rr.com...
    > In article <e5YyCfDtFHA.3264@TK2MSFTNGP12.phx.gbl>, "Conan Kelly"
    > <CTBarbarin at msn dot com> says...
    >> Kevin,
    >>
    >> Thanks for the info. You can check out my screenshot here:
    >> http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg
    >
    > Any account that starts with an S and a bunch of numbers is a
    > disconnected account - you see this when the local computer can't
    > reach
    > the domain to get the accounts name resolved properly.
    >
    > If you setup a couple computers in a domain, then change the domain
    > name
    > or remove the computer from the domain, so that the domain
    > controller is
    > no longer accessible, you will see accounts like that.
    >
    > You may also see accounts like that if you've recovered a corrupted
    > local OS.
    >
    > Unless you are using a domain that you have disconnected
    > temporarily,
    > it's most likely safe to delete it.
    >
    > One thing - before you delete it - you're not using EFS on that
    > folder
    > are you?
    >
    > --
    >
    > spam999free@rrohio.com
    > remove 999 in order to email me
  5. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Thsi will also happen if a user is deleted that had access to this folder.
    Once the user is deleted and the SID can't be resolved it just shows the old
    user's SID.

    "Leythos" <void@nowhere.lan> wrote in message
    news:MPG.1d89e2d1b60e2dd7989f78@news-server.columbus.rr.com...
    > In article <e5YyCfDtFHA.3264@TK2MSFTNGP12.phx.gbl>, "Conan Kelly"
    > <CTBarbarin at msn dot com> says...
    >> Kevin,
    >>
    >> Thanks for the info. You can check out my screenshot here:
    >> http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg
    >
    > Any account that starts with an S and a bunch of numbers is a
    > disconnected account - you see this when the local computer can't reach
    > the domain to get the accounts name resolved properly.
    >
    > If you setup a couple computers in a domain, then change the domain name
    > or remove the computer from the domain, so that the domain controller is
    > no longer accessible, you will see accounts like that.
    >
    > You may also see accounts like that if you've recovered a corrupted
    > local OS.
    >
    > Unless you are using a domain that you have disconnected temporarily,
    > it's most likely safe to delete it.
    >
    > One thing - before you delete it - you're not using EFS on that folder
    > are you?
    >
    > --
    >
    > spam999free@rrohio.com
    > remove 999 in order to email me
  6. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

    Run the registry editor and navigate to this key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\ProfileList

    See if the SID number associated with that user account is
    listed. This may give you a clue as to what the original
    account was.

    To delete this account you can try the following:

    In Control Panel, open System Properites. On the Advanced page,
    click on the Settings button in the User Profiles section. See
    if there's an entry for "Account Unknown". Select that entry to
    hightlight the account and hit the delete button.

    Good luck

    Nepatsfan

    Conan Kelly wrote:
    > Leythos, Kevin, and MTENet,
    >
    > Thank you for all of your feed back. It is very much
    > appreciated.
    > Leythos, to answer your question: No, I'm not using EFS on
    > any of my files/folders.
    >
    > Now how do I go about making sure I've removed it? It
    > didn't show up in Computer Managment>System Tools>Local
    > Users & Groups>Users and it didn't show up in HKEY_USERS.
    > When I when to Share Properties>Security Tab>, I selected
    > Unknown Account and clicked Remove. It took along time to
    > do its thing (I think it may have removed it from the other
    > shares, but I did not verify).
    > Once again, thanks for everyone's help,
    >
    > Conan Kelly
    >
    >
    >
    > "Leythos" <void@nowhere.lan> wrote in message
    > news:MPG.1d89e2d1b60e2dd7989f78@news-server.columbus.rr.com...
    >> In article <e5YyCfDtFHA.3264@TK2MSFTNGP12.phx.gbl>, "Conan
    >> Kelly" <CTBarbarin at msn dot com> says...
    >>> Kevin,
    >>>
    >>> Thanks for the info. You can check out my screenshot here:
    >>> http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg
    >>
    >> Any account that starts with an S and a bunch of numbers is
    >> a disconnected account - you see this when the local
    >> computer can't reach
    >> the domain to get the accounts name resolved properly.
    >>
    >> If you setup a couple computers in a domain, then change
    >> the domain name
    >> or remove the computer from the domain, so that the domain
    >> controller is
    >> no longer accessible, you will see accounts like that.
    >>
    >> You may also see accounts like that if you've recovered a
    >> corrupted local OS.
    >>
    >> Unless you are using a domain that you have disconnected
    >> temporarily,
    >> it's most likely safe to delete it.
    >>
    >> One thing - before you delete it - you're not using EFS on
    >> that folder
    >> are you?
    >>
    >> --
    >>
    >> spam999free@rrohio.com
    >> remove 999 in order to email me
  7. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

    Thanks again to everyone. Your help is much appreciated.

    Conan Kelly
  8. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

    In article <#eq0KtJtFHA.1252@TK2MSFTNGP09.phx.gbl>, "Conan Kelly"
    <CTBarbarin at msn dot com> says...
    > Leythos, Kevin, and MTENet,
    >
    > Thank you for all of your feed back. It is very much appreciated.
    >
    > Leythos, to answer your question: No, I'm not using EFS on any of my
    > files/folders.
    >
    > Now how do I go about making sure I've removed it? It didn't show up
    > in Computer Managment>System Tools>Local Users & Groups>Users and it
    > didn't show up in HKEY_USERS. When I when to Share
    > Properties>Security Tab>, I selected Unknown Account and clicked
    > Remove. It took along time to do its thing (I think it may have
    > removed it from the other shares, but I did not verify).

    You will have to remove it where-ever you find it.

    --

    spam999free@rrohio.com
    remove 999 in order to email me
Ask a new question

Read More

Security Microsoft Windows XP