?unknown

I am seeing an account called ?unknown while reviewing permissions for shares. DUMPSEC report was generated by the administrator of the local domain controller. Anyone seen this before or have any idea what it is?

[cmccullough]

Re: ?unknown

I believe this is indicating that the user or group no longer exists. When entries are added to share or file permissions, Windows doesn't clean those entries up when you delete those users or groups.

Re: ?unknown

thank you.

[kstanush]

Re: ?unknown

Usually these accounts are from trust relationships that no longer exist. If you look at the resource in Windows Explorer, you will probably see something similar. In any case, DumpSec can't resolve the SID back into an account name, which is why the ?unknown is being displayed.