SID S-1-5-21-861567501-651377827-682003330-1007

[Guest]

Hello,

can anyone suggest why we are discovering this SID in the permissions on a
variety of folders on a Windows 2000 Pro PC?

Thanks

 

[Roger Abell]

The most common reason, if other principals are being
shown with their display names, is an account or group
that has been deleted.

 

[Matt Gibson]

Or that account was part of a domain that has since been left.

Matt Gibson - GSEC

 

[Roger Abell]

Or that account was part of a domain that has since been left.

Matt Gibson - GSEC

Yep, or a domain that is unresolvable due to DNS, network,
or even just a stopped Tcp/Ip NetBios helper service, etc..
But usually then, as with a disjoined domain membership,
many principals will be shown as SIDs, etc., there may be
some delays, etc..
I still think deleted principals is the most common though.

 

[Ray]

Doesn't the RID of 1007 mean it was the seventh user account ever created on
the domain? That might help narrow it down.

Ray