Re: S-1-5-21...
Sean W <[email protected]> Mon, 21 Jul 2008 11:34:26 -0700
| Newsgroups | gmane.comp.security.microsoft |
|---|---|
| Message-ID | <[email protected]> |
Those numbers are from deleted user accounts or user accounts that can't be verified with an authenticating domain controller. In other words, the SID cannot be matched to a user name on your PC. --sean > > Red Cat wrote: >> Hey, >> >> I have a question on something I saw on my computer today. I'm on a >> Windows Vista. I was looking at some of the "properties" of some >> folders in my "Public" folder and clicked on the "Security" tab. Then >> I noticed my usual login user, "Everyone", and one other user, whose >> id seemed to be S-1-5-21...and some numbers. Then after a couple >> moments it turned into the user, "None" with (My computer name\None) >> right next to it. I looked at the permissions it was given and >> apparently it was given "Special Permissions." I was pretty sure I >> didn't and never had created a user named "None". But I still checked >> the Users folder to see if there was indeed a user named "None". There >> wasn't. I even checked to see if there were any hidden users using the >> "view hidden folder option", but there was no uesr by the name of >> "None". I looked on google for some time but all I managed to find was >> that it could possibly be a remnant from a past OS or something. But >> this computer had Vista installed on it when I got it. Also, it might >> be some sort of guest that was made for my computer or something. My >> own speculation is that it has something to do with the fact that I >> used Cygwin to open up a tarball and create this folder. Anyway, what >> does this user mean? Why does it have special permissions? Is it some >> sort of sign that I have a back door somewhere on my computer or that >> I'm being keylogged or something? Thanks in advance. >> >> >