What is this (Account Unknown) SID ?

Question

sorry.  in part, while i'm chasing this, i just want to rag about the msdn link
See relative identifier which points to itself.  grrrrr.
question:  what is this weird account   Account Unknown(S-1-5-21-xxxxxxxxxx-yyyyyyyyyy-zzzzzzzzzz-1000)  which has appeared on two different dual-boot installations? 
it appeared as a security acl on every file and folder in the user folder on the older (vista) partition.  it got attached immediately upon accessing that folder the very first time
from the new windows7 installation.  when i first clicked that user folder, windows7 gave a uac prompt and said the accessibility would be made
permanent.  then it went off for about 5 minutes making this change.  that SID exactly matches the filename of a hidden folder in the $recycle.bin.
the first time i saw this, it was very alarming.  that Account Unknown descriptor has full privileges.  i struggled with icacls to remove it, but couldn't figure out how.  then by luck i discovered a very simple way to remove
this security entry globally from every user file it got attached to.  the descriptor "Applies to  This folder, subfolders, and files", so deleting the very first one at the base user folder causes a wizard to go off for another 5
minutes removing all the rest.  easy.
now i've reinstalled them, since that's how windows7 wants it to be.  but i'd like a little insight.  anybody know what this is all about?

Answer 1

I armed myself with a patience of Tao Master. Let's try to sort this out.
You have a dual boot computer?
Windows 7 is installed on one partition?
Windows Vista is installed on another partition?
While you run Windows 7, you check security settings of the folder on your Vista partition?
UAC warns you that you need to supply admin credentials and that the system will make permanent security settings changes to the object you are viewing?
You confirm?
In the properties of the file/folder you see a suspicious looking accont, something like
S-1-5-21-23451392014-3753191404-2044848958-1000 that has FullControl privilege over the file/folder?
You believe it was populated by some mysterious process running in your Windows 7 when you confirmed UAC prompt?
If the above is correct, let's discuss.
1. The suspicious looking unknown account S-1-5-21-23451392014-3753191404-2044848958-1000 is not the full account object, but it's SID. It was created in Vista and is therefore unknown to Windows 7.
2. Permissions in objects are controlled via Access Control List (ACL's). Each list contains a number of entries, called Acess Control Entry (ACE's). ACE consists of security principal's SID, and multiple types of permissions (Read, Write, Execute etc)
, Allow or Deny, Inherited or Explicit.
IOW, the suspicious looking Unknown Account was not populated when you confirmed UAC prompt. It existed before (it was made by Vista). However, it is unknown to your Windows 7 installation, because it was created in Vista installation and lives in a
database called Security Access Manager (SAM) in Vista (Windows\System32\..).
What happened when you acknowledged UAC prompt is that Windows 7 added it's Windows 7 Administrators group with full control permission to the ACL list of your file/folder created from Vista.
If you successfuly removed suspicious looking, Unknown Account, congratulations. Your Vista installation will not work correctly and will probably go to Blue Screen. 
Thank you for that patience; it completely answered a query I had between my laptop upgrade to 8 and access between it and my tower running 7, kudos for the persistence in continuing education in the case of illogical responses. I often swap external HDDs around
when tinkering so that I don't accidentally wipe my data.