Windows Update files: Security permissions has "unknown user"

Question

Ok, this is weird. I have 30 files added in a November Windows update with a compile date or add-to date of 11/21/14. If I look at one of the files. MsSpellCheckingFacility.exe.  I can see it is a legit file.
https://www.virustotal.com/en/file/e9dcf987838e9a70fca4e1b1dda217bd1e309cd4f6bac47402120f76aac6edc7/analysis/
However, the security permissions on the file are strange.  The user TrustedInstaller is the owner.  Now that seems to be typical when the file is a Microsoft updated file.  However, the file also has a user added that is unknown.
user ? S-1-14-21
Umm, why is this?  Its 30 files like this all REAL Microsoft files....all apparently part of the update.  All scanned against virustotal as being revised about that date/time.  Did Microsoft release an Update Build with files as a part
of that build that had Microsoft users still attached to them?

Answer 1

Hi!
This machine is joined to a domain? This SID with parameter "-21-" indicates a domain. If so, it is needed to verify on local polices if any user had permission on domain workstations enforced by network Administration.
But when researching by SID "S-1-14-21" we have no
reference, as parameter "-14-" is not commonly used.
From articles bellow, we can find how SID works and the well known SIDs:
http://msdn.microsoft.com/en-us/library/dd302645.aspx
http://technet.microsoft.com/en-us/library/dn743661.aspx
As this is not a known SID, I suggest you to try to use the script on link bellow to determine who is the user account:
http://blogs.technet.com/b/heyscriptingguy/archive/2004/12/03/how-can-i-determine-the-sid-for-a-user-account.aspx
The problem can be a user account that had already deleted (this is why SID is not resolved to a name) or a problem on WMI component that is not able to resolve SID.
If not successfull with article above, please post a screenshot on file permission in order to help you further.
Cheers!
Alan Martins