Troubleshooting "Acct Info Unavailable" SID found in Quota Managem

When looking at our file server, I've found 1GB attributed to a SID stating
"account infirmation unavailable". I have no idea whether this might pertain
to a user who left the company whose account had been deleted (although that
is what I suspect). Is there any way to do forensics on this SID, to find
out what it was...and determine how to either remove the files for this SID,
or transfer them to the new user?

 

You can navigate to;
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\{SID}
then look at 'ProfileImagePath'

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| When looking at our file server, I've found 1GB attributed to a SID
stating
| "account infirmation unavailable". I have no idea whether this might
pertain
| to a user who left the company whose account had been deleted (although
that
| is what I suspect). Is there any way to do forensics on this SID, to find
| out what it was...and determine how to either remove the files for this
SID,
| or transfer them to the new user?
| --
| pbrill1

 

Dave - Thanks for the info.

I didn't find the SID under there - but when I ran a FIND for the SID, I
found an entry under
HKCU\Software\Microsoft\Protected Storage System Provider\{SID} , that was
close, it ended in a -500, rather than the -1462, -1468 and -2168 SID entries
that my Quota Entries on Disk C: references as [Account Information
Unavailable].

Does this offer any clues?

 

This tool might help but if as you suspect (and I would agree) the account
was deleted then there is probably no way to resolve the account name.

http://www.petri.co.il/obj_sid.htm

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Dave - Thanks for the info.
|
| I didn't find the SID under there - but when I ran a FIND for the SID, I
| found an entry under
| HKCU\Software\Microsoft\Protected Storage System Provider\{SID} , that was
| close, it ended in a -500, rather than the -1462, -1468 and -2168 SID
entries
| that my Quota Entries on Disk C: references as [Account Information
| Unavailable].
|
| Does this offer any clues?
| --
|
| I can't find an account name with it, however
| pbrill1