SID S-1-5-21-861567501-651377827-682003330-1007

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hello,

can anyone suggest why we are discovering this SID in the permissions on a
variety of folders on a Windows 2000 Pro PC?

Thanks
 
The most common reason, if other principals are being
shown with their display names, is an account or group
that has been deleted.
 
Matt Gibson said:
Or that account was part of a domain that has since been left.

Matt Gibson - GSEC
Click to expand...

Yep, or a domain that is unresolvable due to DNS, network,
or even just a stopped Tcp/Ip NetBios helper service, etc..
But usually then, as with a disjoined domain membership,
many principals will be shown as SIDs, etc., there may be
some delays, etc..
I still think deleted principals is the most common though.
 
Doesn't the RID of 1007 mean it was the seventh user account ever created on
the domain? That might help narrow it down.

Ray
 
Back
Top