I discovered some unknown, numeric SID's that have Full Access to some
files in my Windows directory. They appear to be from old logins that
were deleted.

When I go into the Advanced Security setting dialog, it has all the rules that
apply to the C:\Windows directory (5 SIDS representing local users and groups).
The "Inherited From" column says the 5 expected SIDS are inherited from my root
directory -- this is expected.

However, the one numeric SID claims it inherited it's setting from
"Parent Object". I thought the parent object was the directory
above it (In this case, "\Windows"). But the numeric SID isn't listed
in this directory (which I though should have been a parent object).

More "weirdness": At the \Windows level, I set the ACL to point to the root
directory's entry, then chose the option to apply this ACL to all subdirectories
and files. When one propagates an ACL from a parent directory, aren't previous
ACL's removed?

What would be this folder's "Parent Object" (BTW: it is a valid folder
that I created at some point in the past).

Thanks...

(This has me rather curious -- this folder isn't the only file object that
has this numeric SID -- some even have 2 numeric SIDS, yet I know I propagated
permissions from the windows root-dir specifically to eliminate all possible
references to the deleted user)

---
Email: msnews (at) tlinx (dot) org