?unknown

[Guest Close Guest]

I am seeing an account called ?unknown while reviewing permissions for shares. DUMPSEC report was generated by the administrator of the local domain controller. Anyone seen this before or have any idea what it is?

[Guest Close cmccullough]

Re: ?unknown

I believe this is indicating that the user or group no longer exists. When entries are added to share or file permissions, Windows doesn't clean those entries up when you delete those users or groups.

[Guest Close Guest]

Re: ?unknown

thank you.

[kstanush Administrator Find all posts View Profile Close kstanush]

Re: ?unknown

Usually these accounts are from trust relationships that no longer exist. If you look at the resource in Windows Explorer, you will probably see something similar. In any case, DumpSec can't resolve the SID back into an account name, which is why the ?unknown is being displayed.