{"id":74709,"date":"2024-04-08T11:25:38","date_gmt":"2024-04-08T05:55:38","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=74709"},"modified":"2024-04-08T11:37:02","modified_gmt":"2024-04-08T06:07:02","slug":"account-unknown-sid-security-tab","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/account-unknown-sid-security-tab\/","title":{"rendered":"What is “Account Unknown” in the Security tab?"},"content":{"rendered":"

When you check the permissions for a drive, folder, or registry key, you may see the “Account Unknown” entry showing a bunch of random numbers. You wonder what the “Account Unknown” entry refers to.<\/p>\n

\"capability<\/p>\n

The screenshot doesn’t show the full entry. For your convenience, I’m posting it below:<\/p>\n

Account Unknown(S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176)<\/pre>\n
What is “Account Unknown” in the Security tab<\/h2>\n
The bunch of numbers that appear in the security tab is called the Security Identifier (SID).<\/p>\n
The “Account Unknown” SID can mean one of the two things:<\/p>\n
1] The SID is a “Capability SID”.<\/h3>\n
Capability SIDs uniquely and immutably identify capabilities. In this context, a capability is an unforgeable token of authority granting a Windows component or a Universal Windows Application access to resources such as documents, cameras, locations, etc. An application that “has” a capability is granted access to the resource that is associated with the capability. An application that “does not have” a capability is denied access to the associated resource.<\/p>\n
\"tipsAll capability SIDs are prefixed by S-1-15-3<\/strong>.<\/p>\n
Important: <\/strong><\/em>DO NOT DELETE capability SIDS from the Registry or file system permissions. Removing a capability SID from file system or registry permissions may cause a feature or application to function incorrectly. After you remove a capability SID, you cannot use the UI to add it back.\u00a0<\/em><\/div>\n
All capability SIDs that the operating system is aware of are stored in the Windows Registry in the path:<\/p>\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapabilityClasses\\AllCachedCapabilities<\/pre>\n
The most commonly used capability SID is the following:<\/p>\n
S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681<\/pre>\n
Capability SIDs should not<\/strong> be deleted.<\/p>\n
(or)<\/h4>\n
2] The SID of an account no longer exists on this PC.<\/h3>\n
The “Account Unknown” SID could be the SID of an user account deleted from your computer.<\/p>\n
For example, you configure the folder\/registry permissions for a user account named “John”. The Security tab shows the friendly name (i.e., “John”) instead of its SID.<\/p>\n
\"account
ACL entry for an existing user account named “John”<\/figcaption><\/figure>\n
However, when the user account “John” is deleted from the system, the Access Control List (ACL) entry shows up as “Account Unknown”, followed by the deleted account’s SID.<\/p>\n
\"account
ACL showing the SID<\/strong> after deleting the “John” account<\/figcaption><\/figure>\n
Each user account has a unique SID.\u00a0The SID of deleted user accounts can be deleted from the Security tab.<\/p>\n
\"tips As the above SID is not<\/strong> prefixed by S-1-15-3<\/strong>, it’s not a Capability SID. Also, the SID shown in the screenshot is not a Well-Known SID<\/a>. Hence, the orphaned ACL entry that points to a non-existent user account can be deleted.<\/p>\n
References<\/h3>\n
Security identifiers | Microsoft Learn<\/a><\/p>\n
Some SIDs do not resolve into friendly names – Microsoft Learn<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
When you check the permissions for a drive, folder, or registry key, you may see the “Account Unknown” entry showing a bunch of random numbers. You wonder what the “Account Unknown” entry refers to.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[8,869],"tags":[],"class_list":["post-74709","post","type-post","status-publish","format-standard","hentry","category-windows-10","category-windows-11"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":3971,"url":"https:\/\/www.winhelponline.com\/blog\/task-manager-startup-impact-calculated-bootckcl\/","url_meta":{"origin":74709,"position":0},"title":"What is Startup Impact in Task Manager and How is it Calculated?","author":"Ramesh","date":"September 2, 2016","format":false,"excerpt":"You would have noticed a column named \"Startup Impact\" in Task Manager's Startup tab in Windows 8 and higher. But what does \"Startup Impact\" mean and how is it assessed? Task Manager Startup tab lists all startup apps loading from Run, RunOnce registry keys and from the user's Startup folder,\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"task manager startup impact","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/09\/taskmgr-startup-impact-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/09\/taskmgr-startup-impact-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/09\/taskmgr-startup-impact-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":4945,"url":"https:\/\/www.winhelponline.com\/blog\/cannot-install-windows-store-apps-edge-extensions-windows-10\/","url_meta":{"origin":74709,"position":1},"title":"Cannot Install Windows Store Apps and Edge Extensions in Windows 10","author":"Ramesh","date":"December 25, 2016","format":false,"excerpt":"If you're unable to download, install or update the extensions for Microsoft Edge and other Apps available at the Windows Store in Windows 10, this post helps you how to fix those issues. Reset Windows Store using WSReset.exe Close Windows Store if it's running. Press Winkey + R to bring\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/12\/windows-store-header.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/12\/windows-store-header.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/12\/windows-store-header.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":3084,"url":"https:\/\/www.winhelponline.com\/blog\/remove-old-lock-screen-images-history-settings\/","url_meta":{"origin":74709,"position":2},"title":"How to Remove Old Lock Screen Images From Settings Page in Windows 10?","author":"Ramesh","date":"May 5, 2016","format":false,"excerpt":"When you open the Lock Screen Settings page, it shows the thumbnail images of last five lock screen images used. This post tells you how to remove old lock screen picture thumbnails from the history. To remove a thumbnail image from the Lock Screen Background page, click the Browse button\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/05\/lockbg-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":6479,"url":"https:\/\/www.winhelponline.com\/blog\/task-manager-unknown-program-startup-entry-fix\/","url_meta":{"origin":74709,"position":3},"title":"What is “Program” in Task Manager Startup Tab","author":"Ramesh","date":"August 19, 2018","format":false,"excerpt":"When you open Task Manager and click on the Startup tab to manage auto-start entries, you may notice one or more entries showing up as \"Program\" showing up with a blank or generic icon and\u00a0without any Publisher information. The unknown \"Program\" entries are most likely caused if both of the\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"unknown program entry in task manager startup tab command line","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/08\/taskmgr-startup-unknown-program-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/08\/taskmgr-startup-unknown-program-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/08\/taskmgr-startup-unknown-program-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":5819,"url":"https:\/\/www.winhelponline.com\/blog\/fix-event-id-10016-distributedcom-error-event-log-dcomcnfg-permissions\/","url_meta":{"origin":74709,"position":4},"title":"Fix: Event ID 10016 DistributedCOM Errors Recorded in the Event Log","author":"Ramesh","date":"November 4, 2017","format":false,"excerpt":"Even in a fresh Windows 10 installation, you might see some DistributedCOM (DCOM) errors Event ID: 10016 in the System event log. Here are some sample events: Log Name: System Source: Microsoft-Windows-DistributedCOM Date: Event ID: 10016 Task Category: None Level: Error Keywords: Classic User: DESKTOP-JKJ4G5Q\\ramesh Computer: DESKTOP-JKJ4G5Q Description: The machine-default\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"dcom error filter event log xml","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/dcomncfg-filter-event-log.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/dcomncfg-filter-event-log.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/dcomncfg-filter-event-log.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/dcomncfg-filter-event-log.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":19854,"url":"https:\/\/www.winhelponline.com\/blog\/error-0x800707e7-0x3000d-upgrade-windows-10\/","url_meta":{"origin":74709,"position":5},"title":"Error 0x800707E7 0x3000D during Windows Setup","author":"Ramesh","date":"November 13, 2020","format":false,"excerpt":"When you upgrade from Windows 7 or Windows 8 to Windows 10 or 11 or do a repair installation, the error 0x800707E7 \u2013 0x3000D may occur and the setup is canceled automatically. The same error may occur when installing a Feature Update (e.g., upgrading from 21H2 to 22H2). Here is\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"nvidia updatus user account uninstall","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/11\/nvidia-update.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/74709","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=74709"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/74709\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=74709"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=74709"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=74709"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}