Unkown SID

[harry]

Hello Everyone, I am trying to delete a users home folder, but even though I am admin I get the error, denied even after I have taken ownership of the folder I still get the same message.. Looking into it, there is an unknown user with a SID that has full permissions on that folder, inherited from the root folder. I have tried Powershell get-aduser -identity..... and it comes back that they cannot find a user with that SID. The same happens when I look to see if it is a group. ADUC doesn't return anything either.

 

I cannot remove that user from the file security either.

 

Any help would be gratefully appreciated.

 

Many thanks

Harry

[CHiLL]

Is there a file in a folder in a folder in a folder in a folder (etc etc)? I've seen similar issues when the file path is longer than what Windows can support. If so, try deleting via this method: https://www.howtogeek.com/283877/how-to-delete-files-windows-claims-are-too-long/

[harry]

Thanks CHiLL, No, its E:\xxx\xxx so not far up/down? the chain.

[smurfomatic]

As well as taking ownership, have you given the admin account full control in file security, and ticked the "replace all child objects permissions" box? I've found sometimes that - even with ownership of the file - you still can't delete them

[LukeRowberry]

Try deleting it from inside 7zip file manager

[harry]

Thanks smurfomatic and LukeRowberry.

@ smurfomatic I have disabled inheritance on the users folder but I did apply the replace in the child objects.

@ LukeRowberry I will give that a try although I don't know enough about permissions I am not sure how that would work?

 

Cheers,

Dave

[psydii]

Try:

 

psexec to launch cmd.exe as system.

Takeown to give SYSTEM ownership of the folders and files

cacls to grant SYSTEM full permissions

Now as SYSTEM delete the folder subfolder and files.

 

You could also use cacls (running as SYSTEM) to revoke the remissions for the unknown user.

[harry]

Thanks everyone! I will try when I get a moment.

 

Looking further into it, I ran a PowerShell script to get the files permissions and every file has that SID attached with the permission Full control and a second entryof that SID, permission of 268435456. Apparently that is a generic_all permission. Curious and curiouser, well weird.

[psydii]

did you try get-adgroup -identity SID?

 

Only asking because I just saw an unresolved sid in some security logs, and after a moment of panic when get-aduser returned nothing, realized that it might be a group (it was).