Announcement

Collapse
No announcement yet.

?unknown

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • ?unknown

    I am seeing an account called ?unknown while reviewing permissions for shares. DUMPSEC report was generated by the administrator of the local domain controller. Anyone seen this before or have any idea what it is?

  • #2
    Re: ?unknown

    I believe this is indicating that the user or group no longer exists. When entries are added to share or file permissions, Windows doesn't clean those entries up when you delete those users or groups.

    Comment


    • #3
      Re: ?unknown

      thank you.

      Comment


      • #4
        Re: ?unknown

        Usually these accounts are from trust relationships that no longer exist. If you look at the resource in Windows Explorer, you will probably see something similar. In any case, DumpSec can't resolve the SID back into an account name, which is why the ?unknown is being displayed.
        Kevin Stanush
        SystemTools Software Inc.

        Comment

        Working...
        X