Focus on Microsoft
S-1-5-21... Jul 21 2008 04:56PM
Red Cat (redcat9876 gmail com) (3 replies)
RE: S-1-5-21... Jul 23 2008 04:21PM
Nick Vaernhoej (nick vaernhoej capitalcardservices com)
Good morning,

Just a thought.
You mention that the OS was preinstalled. If this was done by a local or
"lesser than Dell" even the infamous Geek Squad.
Could it be (and this is speculation because my exposure to Vista was
short lived), that the install person of the original OS entered a user
name "None" as the initial Administrator of the system. On WinXp you are
forced to create an admin account during OS installation essentially
leaving you with two admin accounts on a fresh install of XP.

What I have seen on an Active Directory domain is that this initial
account is created with a name like "temp" or "none" or similar, and
once the system has been joined to the domain this local administrative
user account is deleted and the system is sysprepped.....


- -----Original Message-----
- From: listbounce (at) securityfocus (dot) com [email concealed]
- [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On Behalf Of Red Cat
- Sent: Monday, July 21, 2008 11:56 AM
- To: focus-ms (at) securityfocus (dot) com [email concealed]
- Subject: S-1-5-21...
- Hey,
- I have a question on something I saw on my computer today. I'm on a
- Windows Vista. I was looking at some of the "properties" of some
- folders in my "Public" folder and clicked on the "Security" tab. Then
- I noticed my usual login user, "Everyone", and one other user, whose
- id seemed to be S-1-5-21...and some numbers. Then after a couple
- moments it turned into the user, "None" with (My computer name\None)
- right next to it. I looked at the permissions it was given and
- apparently it was given "Special Permissions." I was pretty sure I
- didn't and never had created a user named "None". But I still checked
- the Users folder to see if there was indeed a user named "None".
- wasn't. I even checked to see if there were any hidden users using
- "view hidden folder option", but there was no uesr by the name of
- "None". I looked on google for some time but all I managed to find
- that it could possibly be a remnant from a past OS or something. But
- this computer had Vista installed on it when I got it. Also, it might
- be some sort of guest that was made for my computer or something. My
- own speculation is that it has something to do with the fact that I
- used Cygwin to open up a tarball and create this folder. Anyway, what
- does this user mean? Why does it have special permissions? Is it some
- sort of sign that I have a back door somewhere on my computer or that
- I'm being keylogged or something? Thanks in advance.

This electronic transmission is intended for the addressee (s) named above. It contains information that is privileged, confidential, or otherwise protected from use and disclosure. If you are not the intended recipient you are hereby notified that any review, disclosure, copy, or dissemination of this transmission or the taking of any action in reliance on its contents, or other use is strictly prohibited. If you have received this transmission in error, please notify the sender that this message was received in error and then delete this message.
Thank you.

[ reply ]
Re: S-1-5-21... Jul 21 2008 06:22PM
Mike Moratz-Coppins (mike mikeymike org uk)
Re: S-1-5-21... Jul 21 2008 05:29PM
Dennis Li (dennis li sh gmail com) (1 replies)
RE: S-1-5-21... Jul 21 2008 06:37PM
Erik Boles (eboles mxlogic com) (1 replies)
Re: S-1-5-21... Jul 21 2008 06:50PM
Charles Hardin (fonestorm gmail com) (1 replies)
RE: S-1-5-21... Jul 21 2008 07:20PM
Remco (remco bluedome net)


Privacy Statement
Copyright 2010, SecurityFocus