What kind of User Account is this? (screenshot included)

[dahoff]

I just reinstalled XP Pro over the weekend. I've been setting up some basic sharing on the home network and ran across a weird group or username:

"S-1-5-21-1060284298-842925246-839522115-1003" or something. I'm not sure who or what it belongs to, but I don't want my system's security compromised! Thanks!

http://home.cwru.edu/~dah17/whoisthis.jpg (~231 KB)

 

[pitupepito2000]

hmm ...

I personally don't like having an account that I didn't create. What permissions does it have? How long has it been there? What are in the Documents and Settings of that username? I had never herad anything like this, but I would personally watch this account closely, and if it doesn't do anything important I would remove it and see if it breaks anything. I also tried doing a google search, but it didn't bring anything.

Good luck,
pitupepito

 

[dahoff]

I updated the image with more screenshots.

Basically, here's my setup:

Hard Drive 1:
C: (Windows and apps) <--I reformatted this a few days ago.
D: (My Data)

Hard Drive 2:
E: (My Data)

I only have one user account on my PC. Just Administrator, which is under my name. "Booze" is the name of my computer.

Apparently this user account has ownership or something of my Admin account. I'm really pretty new to Windows sharing and security. I currently have *nothing* shared, although C$, D$, and E$ are shared for administrative purposes (I guess this is all local sharing and is different from network sharing?).

Anyway, I wonder if it's just a default Windows serial or something and I can easily change it. I can't remove it because it says it is inheriting permissions from the parent, which I assume is drive E. However the "E:" doesn't have this account listed. This is only visible on a few of the folders in E. "DebugTemp" is just one example.

---------
I'll run a full system virus scan and report back. Ad-Aware shows no threats.

Thanks.

 

[pitupepito2000]

As I said before, I really have no clue, what this accou7nt is. But I'm thinking that this account was created because you were setting up sharing of resources in windows XP, That looks like a random generated #, Is that part of your Access Key? Does that number appear in the registry? I would presonally think since you reinstalled your OS not long ago, this is probably because of setting up sharings in XP. The chances of getting a virus or something like that in a few days isn't very high. You can always run an antiviurs, ad-aware programs just to be in the safe-side. Does this account disappear when you disable sharing?

Good luck,
pitupepito

 

[MrChad]

What you're seeing is a security identifier (SID). Each user is assigned a unique SID in Windows, which lets the OS keep track of security permissions and user-specific settings. I'm guessing that the user you are seeing is a network user, not a local user. That would explain why your machine cannot resolve the proper username.

Text

 

[Sunner]

Originally posted by: MrChad
What you're seeing is a security identifier (SID). Each user is assigned a unique SID in Windows, which lets the OS keep track of security permissions and user-specific settings. I'm guessing that the user you are seeing is a network user, not a local user. That would explain why your machine cannot resolve the proper username.

Text

Yeah, for example when a computer is part of a domain, and has rights asigned to domain users, the usernames will look like that if the domain becomes unavailable.

And on a cool sidenote, my workgroup at home is named BOOZE

 

[Kilrsat]

Originally posted by: dahoff
I updated the image with more screenshots.

Basically, here's my setup:

Hard Drive 1:
C: (Windows and apps) <--I reformatted this a few days ago.
D: (My Data)

Hard Drive 2:
E: (My Data)

I only have one user account on my PC. Just Administrator, which is under my name. "Booze" is the name of my computer.

Apparently this user account has ownership or something of my Admin account. I'm really pretty new to Windows sharing and security. I currently have *nothing* shared, although C$, D$, and E$ are shared for administrative purposes (I guess this is all local sharing and is different from network sharing?).

Anyway, I wonder if it's just a default Windows serial or something and I can easily change it. I can't remove it because it says it is inheriting permissions from the parent, which I assume is drive E. However the "E:" doesn't have this account listed. This is only visible on a few of the folders in E. "DebugTemp" is just one example.

---------
I'll run a full system virus scan and report back. Ad-Aware shows no threats.

Thanks.

If you formatted C: and reinstalled without also formatting your E: drive then the SID you're seeing is most likely an account from the previous Windows install.

NTFS associates the SIDs of the user accounts for permissions, not just account names, and so when you formatted windows the friendly account name for that particular SID doesn't exist anymore. The files still have the old permissions associated with them, simply take ownership of any files/folders that the previous account owns and it should disappear.

 

[NightCrawler]

This occurs when you have two or more Windows installations. I noticed it when I had Windows XP on two partitions and Longhorn install.

Nothing to worry about.

 

[Winchester]

I have found that I get that user format whenever I have deleted or changed a real user from AD and everything has not been updated yet.

 

[LiLithTecH]

Any 7013 errors logged in the EVENT LOG?