unknown User account

[ByTeWrangler]

Hi,
I use WIndows XP Home edition completely updated. while changing permission for accessing and/or editing folders on a specific drive i saw an unknown user account i cannot remove this account and i dont know who has created it.
I would like to know how to remove this account and more importantly who created this account ?
I am only one with password to the administrator account, and i only use it for installing software and changing permissions in safe mode.

[MrLinus]

Microsoft's Knowledgebase knows all. This might help.

[Tiger Shark]

It's an account that "got lost". You see them when you connect and disconnect from domains or workgroups. The SID is there but there is no longer a name attached to it. As you can see it says you cannot remove it from the tree because it is inheriting from above. Go to the highest part of the tree this account exists in and delete it's rights there.

You will probably also find it in the users list. Deleting it there will do all the work for you.

[ByTeWrangler]

hey thanks for the advise but i couldn't find the account in the users list, Ill have to reboot in safe mode and try your second approach of deleting the first account in the list anyway ill get back to you. thanks again.

[Tiger Shark]

You shouldn't need to go to safe mode. Just go up through the parent folders till it doesn't inherit from above and remove it from the permissions list.

[Ghost_25inf]

Try Disabling the Account

[ByTeWrangler]

okay it doesn't appear in the list anymore. thanks for all the help. and tiger shark please explain your post in simpler way.

[Tiger Shark]

Byte: OK...

There are times when you look at the security tab for a given folder that you will see odd looking users like the one in your attachment. What you are seeing is the SSID of a user that is no longer associated to a name in the users list of the computer, This often occurs when you join a computer to a domain and a domain administrator is added to the security tab of the local drive at the root level. Because, by default, these rights are allowed to flow down the directory tree you will then find the domain administrator in all subfolders of C:.

If you subsequently remove the computer from the domain then the user can no longer be assiciated with the SSID that is assigned rights to C:. Thus when you look at the security tab you can only see the SSID. As you discovered you cannot remove a user from a folder, (you can deny them but not remove them), when they are inheriting their rights from the folder above. Thus you need to work your way back up the folder tree until you find the user is no longer inheriting from above. This is the point you can remove the user and it will remove them from all subfolders.

Is that any clearer.

[ByTeWrangler]

perfect.