"Unknow User Account" makes me nervous

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

Hello all,

I've noticed an unknow user account in the "Security" tab in the
"Properties" dialogue box of my files/folders. This makes me nervous.

It may have showed up about the time I started a new job (within the last 3
months--have had the computer for 3+ years) in a small office. I brought my
personal laptop in to use until they were able to get a machine ordered for
me. I had to join their domain. Since then, I've reverted back to
"Workgroup" networking, but the account is still there.

I can post/email a screen print for anyone who wants to see it. (I don't
know if we are allowed to attach files to posts in these NG's--please let me
know!)

Is this supposed to be there? If not, can it be removed?

Thanks for any help anyone can provide,

Conan Kelly

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

If you have a screenshot post it on a personal web page. Don't post it
here. Have the IT staff in your office take a look at the laptop and they
should be able to get rid of that entry for you.

"Conan Kelly" <CTBarbarin at msn dot com> wrote in message
news:ewGByU$sFHA.284@TK2MSFTNGP14.phx.gbl...
> Hello all,
>
> I've noticed an unknow user account in the "Security" tab in the
> "Properties" dialogue box of my files/folders. This makes me nervous.
>
> It may have showed up about the time I started a new job (within the last
> 3 months--have had the computer for 3+ years) in a small office. I
> brought my personal laptop in to use until they were able to get a machine
> ordered for me. I had to join their domain. Since then, I've reverted
> back to "Workgroup" networking, but the account is still there.
>
> I can post/email a screen print for anyone who wants to see it. (I don't
> know if we are allowed to attach files to posts in these NG's--please let
> me know!)
>
> Is this supposed to be there? If not, can it be removed?
>
> Thanks for any help anyone can provide,
>
> Conan Kelly
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

Kevin,

Thanks for the info. You can check out my screenshot here:
http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg


This small business consists of 10 people total, (5 locally in this office I
work in). The guy who is mainly in charge of the systems does not come from
a network admin background. And considering that I'm a computer student,
him and I are the IT Dept. The other option is calling the outside
networking company (but at however many 100's of dollars per hour, that is
not going to be my first choice). I'm not even sure that it did come from
joining my company's domain.

Thanks for any help you can provide,

Conan




"Kevin" <webman6@hotmail.com> wrote in message
news:%23IcxgkCtFHA.2948@TK2MSFTNGP10.phx.gbl...
> If you have a screenshot post it on a personal web page. Don't post it
> here. Have the IT staff in your office take a look at the laptop and they
> should be able to get rid of that entry for you.
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

In article <e5YyCfDtFHA.3264@TK2MSFTNGP12.phx.gbl>, "Conan Kelly"
<CTBarbarin at msn dot com> says...
> Kevin,
>
> Thanks for the info. You can check out my screenshot here:
> http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg

Any account that starts with an S and a bunch of numbers is a
disconnected account - you see this when the local computer can't reach
the domain to get the accounts name resolved properly.

If you setup a couple computers in a domain, then change the domain name
or remove the computer from the domain, so that the domain controller is
no longer accessible, you will see accounts like that.

You may also see accounts like that if you've recovered a corrupted
local OS.

Unless you are using a domain that you have disconnected temporarily,
it's most likely safe to delete it.

One thing - before you delete it - you're not using EFS on that folder
are you?

--

spam999free@rrohio.com
remove 999 in order to email me

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

Leythos, Kevin, and MTENet,

Thank you for all of your feed back. It is very much appreciated.

Leythos, to answer your question: No, I'm not using EFS on any of my
files/folders.

Now how do I go about making sure I've removed it? It didn't show up
in Computer Managment>System Tools>Local Users & Groups>Users and it
didn't show up in HKEY_USERS. When I when to Share
Properties>Security Tab>, I selected Unknown Account and clicked
Remove. It took along time to do its thing (I think it may have
removed it from the other shares, but I did not verify).

Once again, thanks for everyone's help,

Conan Kelly



"Leythos" <void@nowhere.lan> wrote in message
news:MPG.1d89e2d1b60e2dd7989f78@news-server.columbus.rr.com...
> In article <e5YyCfDtFHA.3264@TK2MSFTNGP12.phx.gbl>, "Conan Kelly"
> <CTBarbarin at msn dot com> says...
>> Kevin,
>>
>> Thanks for the info. You can check out my screenshot here:
>> http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg
>
> Any account that starts with an S and a bunch of numbers is a
> disconnected account - you see this when the local computer can't
> reach
> the domain to get the accounts name resolved properly.
>
> If you setup a couple computers in a domain, then change the domain
> name
> or remove the computer from the domain, so that the domain
> controller is
> no longer accessible, you will see accounts like that.
>
> You may also see accounts like that if you've recovered a corrupted
> local OS.
>
> Unless you are using a domain that you have disconnected
> temporarily,
> it's most likely safe to delete it.
>
> One thing - before you delete it - you're not using EFS on that
> folder
> are you?
>
> --
>
> spam999free@rrohio.com
> remove 999 in order to email me

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Thsi will also happen if a user is deleted that had access to this folder.
Once the user is deleted and the SID can't be resolved it just shows the old
user's SID.

"Leythos" <void@nowhere.lan> wrote in message
news:MPG.1d89e2d1b60e2dd7989f78@news-server.columbus.rr.com...
> In article <e5YyCfDtFHA.3264@TK2MSFTNGP12.phx.gbl>, "Conan Kelly"
> <CTBarbarin at msn dot com> says...
>> Kevin,
>>
>> Thanks for the info. You can check out my screenshot here:
>> http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg
>
> Any account that starts with an S and a bunch of numbers is a
> disconnected account - you see this when the local computer can't reach
> the domain to get the accounts name resolved properly.
>
> If you setup a couple computers in a domain, then change the domain name
> or remove the computer from the domain, so that the domain controller is
> no longer accessible, you will see accounts like that.
>
> You may also see accounts like that if you've recovered a corrupted
> local OS.
>
> Unless you are using a domain that you have disconnected temporarily,
> it's most likely safe to delete it.
>
> One thing - before you delete it - you're not using EFS on that folder
> are you?
>
> --
>
> spam999free@rrohio.com
> remove 999 in order to email me

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

Run the registry editor and navigate to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList

See if the SID number associated with that user account is
listed. This may give you a clue as to what the original
account was.

To delete this account you can try the following:

In Control Panel, open System Properites. On the Advanced page,
click on the Settings button in the User Profiles section. See
if there's an entry for "Account Unknown". Select that entry to
hightlight the account and hit the delete button.

Good luck

Nepatsfan

Conan Kelly wrote:
> Leythos, Kevin, and MTENet,
>
> Thank you for all of your feed back. It is very much
> appreciated.
> Leythos, to answer your question: No, I'm not using EFS on
> any of my files/folders.
>
> Now how do I go about making sure I've removed it? It
> didn't show up in Computer Managment>System Tools>Local
> Users & Groups>Users and it didn't show up in HKEY_USERS.
> When I when to Share Properties>Security Tab>, I selected
> Unknown Account and clicked Remove. It took along time to
> do its thing (I think it may have removed it from the other
> shares, but I did not verify).
> Once again, thanks for everyone's help,
>
> Conan Kelly
>
>
>
> "Leythos" <void@nowhere.lan> wrote in message
> news:MPG.1d89e2d1b60e2dd7989f78@news-server.columbus.rr.com...
>> In article <e5YyCfDtFHA.3264@TK2MSFTNGP12.phx.gbl>, "Conan
>> Kelly" <CTBarbarin at msn dot com> says...
>>> Kevin,
>>>
>>> Thanks for the info. You can check out my screenshot here:
>>> http://home.att.net/~ctbarbarin/files/unknown_user_account.jpg
>>
>> Any account that starts with an S and a bunch of numbers is
>> a disconnected account - you see this when the local
>> computer can't reach
>> the domain to get the accounts name resolved properly.
>>
>> If you setup a couple computers in a domain, then change
>> the domain name
>> or remove the computer from the domain, so that the domain
>> controller is
>> no longer accessible, you will see accounts like that.
>>
>> You may also see accounts like that if you've recovered a
>> corrupted local OS.
>>
>> Unless you are using a domain that you have disconnected
>> temporarily,
>> it's most likely safe to delete it.
>>
>> One thing - before you delete it - you're not using EFS on
>> that folder
>> are you?
>>
>> --
>>
>> spam999free@rrohio.com
>> remove 999 in order to email me

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

Thanks again to everyone. Your help is much appreciated.

Conan Kelly

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.windowsxp.security_admin (More info?)

In article <#eq0KtJtFHA.1252@TK2MSFTNGP09.phx.gbl>, "Conan Kelly"
<CTBarbarin at msn dot com> says...
> Leythos, Kevin, and MTENet,
>
> Thank you for all of your feed back. It is very much appreciated.
>
> Leythos, to answer your question: No, I'm not using EFS on any of my
> files/folders.
>
> Now how do I go about making sure I've removed it? It didn't show up
> in Computer Managment>System Tools>Local Users & Groups>Users and it
> didn't show up in HKEY_USERS. When I when to Share
> Properties>Security Tab>, I selected Unknown Account and clicked
> Remove. It took along time to do its thing (I think it may have
> removed it from the other shares, but I did not verify).

You will have to remove it where-ever you find it.

--

spam999free@rrohio.com
remove 999 in order to email me