Ownerless PST Files

Overview

We encounter "ownerless" PST files when we can't identify the owner from the information we have. This usually happens because we use SIDs to find the owner, but sometimes these SIDs don't match up with any user in Active Directory. When AD can't find the owner, we label it as "Unknown."

Cause

• SID Lookup:
  • We get the SID for the NTFS Owner of a PST file.
  • We then try to resolve this SID using Active Directory.
  • If AD can't resolve the SID, we can't determine the owner, so the NTFSOwnerAccount is set to "Unknown."

When you look at the SID's for these "Unknown" files and try to resolve them from our Database, you also get nothing back.

SELECT * FROM pstfile INNER JOIN pstfileowner ON pstfile.pstfileid = pstfileowner.pstfileid WHERE pstfile.ComputerCentralUncShareId IS NOT NULL

SELECT * FROM [user] WHERE sid IN ('S-1-5-21-1577736348-71245783-141775753-13775', 'S-1-5-21-1007556348-73757583-1417075333-367758')

Summary

In short, "ownerless" PST files show "Unknown" as the owner because the SIDs can't be resolved by Active Directory.