Windows 10: Account Unknown Under File Permissions / also TrustedInstaller

For anyone who gets stuck with not being able to Delete a Folder or File due to an oddball User such as S-1-5 etc, or even TrustedInstaller, here is the process to follow. You will typically come across it when you see a User called S-1-5- xxxx etc. or something similar to that. This tutorial also applies to TrustedInstaller if that user is preventing you from deleting a Folder. These S-1-5 xxx type users are usually left over from a partition clone, folder copy from another system etc. Basically all you need to do is take Ownership of the Folder/File. Then you can delete that oddball user

:)

 

Account Unknown Under File Permissions / also TrustedInstaller

For anyone who gets stuck with not being able to Delete a Folder or File due to an oddball User such as S-1-5 etc, or even TrustedInstaller, here is the process to follow.

You will typically come across it when you see a User called S-1-5- xxxx etc. or something similar to that. This tutorial also applies to TrustedInstaller if that user is preventing you from deleting a Folder.

These S-1-5 xxx type users are usually left over from a partition clone, folder copy from another system etc.

Basically all you need to do is take Ownership of the Folder/File. Then you can delete that oddball user(s) and then you can increase the Permissions of another User you have access to so you can Delete the problomatic Folder

You can even just add a new User called Everyone if all you want to do is Delete the Folder/File and set that user to Full permissions just for the purpose. But you must first get rid of the oddball users as per the steps below.

Ok so here are the steps.

1) Make sure you start Explorer (or whatever app you use. I use XYPlorer) in Administration mode. Right click on the app, select Run as Administrator.

2) Right click on the File/Folder you want to handle. Select Properties. Then select the tab that says Security.

You should see the troublesome users listed as I mentioned for example S-1-5-xxx or something similar to that.

3) You will want to delete these oddball users. But generally you will need to take control of the Folder/File as one of those odball items might have control.

4) Select the Advanced button bottom right.

Select the Owner tab

Edit

Select one of the other items listed there. Usually you would select Administrator, or your own user account, assuming you have Admin rights.

Select the checkbox that says - Replace owners on subcontainers and objects

Click Apply

You will get a message asking if this is what you want to do. Click Yes.

It might now take a couple of minutes to set your new Owner depending on how big the Folder is. Files are just immediate.

5) Once that has completed, it will tell you to close the Permissions screens and reopen it. Do that. Close all dialogs.

6) Once again Right click on the Folder/File you are working on. Again make sure your file explorer is still using, Run as Administrator. It should be if you have not closed it. Select Properties and then the Security tab.

7) Select the Edit button.

Click on the users you want to get rid of. S-1-5- etc. Even TrustedInstaller if that user is preventing you from deleting the Folder.

Click Remove ( redo these two steps for each one)

Click Apply, then click OK.

That dialog will now close. You will be back to the first dialog. Here again we need to tell all the files and any subfolders that this change has been made, which will then allow you to Delete that problomatic Folder/File.

NOTE: If you only needed to delete a File, you do not need to do the following. Step 8 is only if you are wanting to remove a Folder.

The File can just be deleted now. And that's it.

8) Once again Right click on the Folder, select Properties, then the Security tab.

Select the Advanced button.

Now select the Change Permissions button.

Now select the Checkbox - Replace all child object permissions ..... NOTE: Only this checkbox. NOT the other one !

Click Apply.

Answer Ok/Yes to the popup message asking if you want to continue.

Once again wait a couple of minutes depending on the size of the Folder.

When it finshes, click OK at the bottom of the dialog.

Click OK again at the bottom of the next dialog.

Lastly, click OK at the bottom of the last dialog (which is the Security tab)

9) Now the Fun bit. You can Delete the Folder. As mentioned if it was just a File you needed to get rid of, you would not need to do Step 8 and could have just deleted the file.

Hope this was helpful.

 

TrustedInstaller permissions

It's because you are are just typing 'TrustedInstaller'. That works to find the common user, group or security principle names, such as your user name or SYSTEM, but for TrustedInstaller you'll only be able to find it when you click 'Check Names' it if you type its full name: NT Service\TrustedInstaller

Edit: but I see you have already found and used that *Wink

 

Account Unknown Under File Permissions

Recently, in troubleshooting another issue, the support tech created a new local admin user "TEST" on my machine. I don't believe any file permissions were manually assigned.



That did not address the problem, and they deleted the user.



When I go to a file or directory and do Properties, Security, I see "Account Unknown(S....)".



I try to remove that and get:



You can't remove Account Unknown(S.....) because this object is inheriting permissions from its parent. To remove Account Unknown you must prevent this object from inheriting permissions. Turn off the option for inheriting permissions, and they try removing Account Unknown again.

If I turn off inheritance, what problems might that cause in the future? Or do I then turn it back on later?

I've seen some articles about this, but am afraid I'm going to keep digging a deeper hole by trying things and decided to put down the shovel and ask for more expert advice.

Thank you in advance.

Thank you,

Scott