Re: File ownership been changed


"John John" <audetweld@xxxxxxxxxxx> wrote in message
news:OeGtwP1NIHA.5400@xxxxxxxxxxxxxxxxxxxxxxx
Who's Fred? Is there a profile folder named "MYPCNAME\Fred"? These
"MachineName\UserName" folders often/usually appear when user profile
corruption is encountered. When a user tries to logon if the Security
Account Manager (SAM) recognizes the user name and password at logon and
if it has no valid reason to refuse the logon, it allows the user to logon
with a new profile, it creates a new profile folder from the Default User
profile and names it as you see. Sometimes you will see folders renamed
in a fashion as UserName.nnn (UserName.001, UserName.002...). The
"MachineName\UserName" folders can also appear when you join machines to a
domain but being that you are using XP Home that doesn't apply to you.

As for the S-1-5-21-11...... numbers, these are called Security
Identifiers (SID) and that is really how all security and logon
information is processed. The operating system uses SID's, but being that
we humans would be quite confused trying to keep track of these series of
numbers and that it would be quite confusing and a royal pain to try to
use SID's, the operating system reconciles our UserNames with the actual
SID's, with Windows NT/2000/XP/Vista user accounts and security, SID's are
the only thing that really matter.

As to how to do a "wholesale" change of all security attributes from
"Fred" to "David" the only (somewhat) easy way to do that is with the
SubInACL tool. You can download SubInACL on the Microsoft web site. The
SubInACL syntax is rather complex, to replace a user with another one the
short syntax will be something like this:

subinacl /C:\*.* /replace=SomeUserName=SomeOtherUserName

(Note that if there are spaces in the user names you have to use quotation
marks):

subinacl /C:\*.* /replace="Some User Name=Some Other UserName"

but in reality the above may halt on errors and it has no log to verify
what was done, it usually works better with a more qualified syntax like
this:

subinacl /outputlog=c:\mytest.log /subdirec=directoriesonly C:\*.*
/replace=SomeUser=SomeOtherUser /ifchangecontinue /noverbose /display
/testmode

If you copy and paste the above pay attention to the spaces, there is
always a space *before* the slash (/). The /testmode switch above allows
you to run the command without actually doing the changes, the results of
the command will be recorded in the c:\mytest.log, you can open and see
what changes would be made by running the command, if you are satisfied
that all is ok remove the /testmode switch and rerun the command to make
the actual changes.

To copy (backup) the ACL/permissions before you replace them send the
output of the permissions to a file, then if you make errors or if you do
not like the changes that you made you can use the /playfile switch to
undo changes you make:

To backup:

subinacl /noverbose /output=c:\backACL.txt /subdirec=directoriesonly
C:\*.*


To restore:

subinacl /playfile c:\backACL.txt

SubInACL documentation
http://www.analogduck.com/main/subinacl

SubInACL (SubInACL.exe)
http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

John

DavidM wrote:

Running XP Home SP2 (logged in with admin rights)

In Windows Explorer I have just displayed the Owner column, and
noticed that a lot of my files have the owner shown as something like
S-1-5-21-11......plus lots of digits, whereas files created recently
have MYPCNAME\Fred. This seems to apply to "data" files that
I restored when I had to rebuild my system a few weeks ago. My
family's files have a similar problem (with different digits).

Is there any way I can restore the correct file ownership, preferabley
in bulk, for each user, or would it be better to leave well alone?

Thanks, David.

Thanks for the detailed reply John.
There isn't a user call Fred, I just made that up, the username for
my more recently created files is pcname\David (pcname is made
up as well).
Can I use the SubInACL tool to replace the wrong SID with one
that matches to my name, and how do I find the current SID for
my name.
I suppose I could just make a copy of every old file, the copy will
then have my correct owner name, then delete the old files. A bit
tedious but seems to work when I tested it on a single file.
Is there any downside in just leaving things as they are, other than
being a bit "untidy"?
David.


.

Relevant Pages

  • Re: File ownership been changed
    ... When a user tries to logon if the Security Account Manager recognizes the user name and password at logon and if it has no valid reason to refuse the logon, it allows the user to logon with a new profile, it creates a new profile folder from the Default User profile and names it as you see. ... As to how to do a "wholesale" change of all security attributes from "Fred" to "David" the only easy way to do that is with the SubInACL tool. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: File ownership been changed
    ... These "MachineName\UserName" folders often/usually appear when user profile corruption is encountered. ... When a user tries to logon if the Security Account Manager recognizes the user name and password at logon and if it has no valid reason to refuse the logon, it allows the user to logon with a new profile, it creates a new profile folder from the Default User profile and names it as you see. ... As to how to do a "wholesale" change of all security attributes from "Fred" to "David" the only easy way to do that is with the SubInACL tool. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: error that my profile cant be loaded at logon
    ... Had I to give a full control or I ... > I get an error that my profile can't be loaded at logon. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Logon Error - Event ID 533
    ... The suggestion regarding security logs should not apply if the overwrite option has been selected and you have the default maximum of 512 kb. ... How to Set Log Size and Overwrite Options ... The user cannot logon and no Profile folder is made, ... screen whether with a domain account or a local account from the ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Help with Security Logs
    ... Security" means that the event was generated by the security ... Primary User is the user context that actually performed the access; ... Client User is the user on behalf of whom the file was accessed. ... The Logon ID fields for Primary User and Client User identify a unique logon ...
    (microsoft.public.security)
Quantcast