Troubleshooting "Acct Info Unavailable" SID found in Quota Managem

Discussion in 'Windows Server' started by pbrill1, Oct 31, 2006.

  1. pbrill1

    pbrill1 Guest

    When looking at our file server, I've found 1GB attributed to a SID stating
    "account infirmation unavailable". I have no idea whether this might pertain
    to a user who left the company whose account had been deleted (although that
    is what I suspect). Is there any way to do forensics on this SID, to find
    out what it was...and determine how to either remove the files for this SID,
    or transfer them to the new user?
     
    pbrill1, Oct 31, 2006
    #1
    1. Advertisements

  2. pbrill1

    Dave Patrick Guest

    You can navigate to;
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\{SID}
    then look at 'ProfileImagePath'

    --

    Regards,

    Dave Patrick ....Please no email replies - reply in newsgroup.
    Microsoft Certified Professional
    Microsoft MVP [Windows]
    http://www.microsoft.com/protect

    :
    | When looking at our file server, I've found 1GB attributed to a SID
    stating
    | "account infirmation unavailable". I have no idea whether this might
    pertain
    | to a user who left the company whose account had been deleted (although
    that
    | is what I suspect). Is there any way to do forensics on this SID, to find
    | out what it was...and determine how to either remove the files for this
    SID,
    | or transfer them to the new user?
    | --
    | pbrill1
     
    Dave Patrick, Oct 31, 2006
    #2
    1. Advertisements

  3. pbrill1

    pbrill1 Guest

    Dave - Thanks for the info.

    I didn't find the SID under there - but when I ran a FIND for the SID, I
    found an entry under
    HKCU\Software\Microsoft\Protected Storage System Provider\{SID} , that was
    close, it ended in a -500, rather than the -1462, -1468 and -2168 SID entries
    that my Quota Entries on Disk C: references as [Account Information
    Unavailable].

    Does this offer any clues?
     
    pbrill1, Oct 31, 2006
    #3
  4. pbrill1

    Dave Patrick Guest

    This tool might help but if as you suspect (and I would agree) the account
    was deleted then there is probably no way to resolve the account name.

    http://www.petri.co.il/obj_sid.htm

    --

    Regards,

    Dave Patrick ....Please no email replies - reply in newsgroup.
    Microsoft Certified Professional
    Microsoft MVP [Windows]
    http://www.microsoft.com/protect

    :
    | Dave - Thanks for the info.
    |
    | I didn't find the SID under there - but when I ran a FIND for the SID, I
    | found an entry under
    | HKCU\Software\Microsoft\Protected Storage System Provider\{SID} , that was
    | close, it ended in a -500, rather than the -1462, -1468 and -2168 SID
    entries
    | that my Quota Entries on Disk C: references as [Account Information
    | Unavailable].
    |
    | Does this offer any clues?
    | --
    |
    | I can't find an account name with it, however
    | pbrill1
     
    Dave Patrick, Oct 31, 2006
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.