Re: S-1-5-21...

Sean W <[email protected]> Mon, 21 Jul 2008 11:34:26 -0700
Newsgroups gmane.comp.security.microsoft
Message-ID <[email protected]>
Those numbers are from deleted user accounts or user accounts that can't 
be verified with an authenticating domain controller.  In other words, 
the SID cannot be matched to a user name on your PC.

 --sean
>
> Red Cat wrote:
>> Hey,
>>
>> I have a question on something I saw on my computer today. I'm on a
>> Windows Vista. I was looking at some of the "properties" of some
>> folders in my "Public" folder and clicked on the "Security" tab. Then
>> I noticed my usual login user, "Everyone", and one other user, whose
>> id seemed to be S-1-5-21...and some numbers. Then after a couple
>> moments it turned into the user, "None" with (My computer name\None)
>> right next to it. I looked at the permissions it was given and
>> apparently it was given "Special Permissions." I was pretty sure I
>> didn't and never had created a user named "None". But I still checked
>> the Users folder to see if there was indeed a user named "None". There
>> wasn't. I even checked to see if there were any hidden users using the
>> "view hidden folder option", but there was no uesr by the name of
>> "None". I looked on google for some time but all I managed to find was
>> that it could possibly be a remnant from a past OS or something. But
>> this computer had Vista installed on it when I got it. Also, it might
>> be some sort of guest that was made for my computer or something. My
>> own speculation is that it has something to do with the fact that I
>> used Cygwin to open up a tarball and create this folder. Anyway, what
>> does this user mean? Why does it have special permissions? Is it some
>> sort of sign that I have a back door somewhere on my computer or that
>> I'm being keylogged or something? Thanks in advance.
>>
>>   
>