See recycle bin contents of all users 1

[CondorMan]

Hi everyone

No, I don't usually do this(!), but I wondered why it's not possible via Windows Explorer.

I have XP Pro SP2 and have two accounts set up, in addition to the built-in hidden Administrator. One of the accounts that I've set up has Limited rights and the other has Admin rights.

I logged in with Limited rights and unchecked "Hide protected operating system files". I went to Start>Run>&%systemdrive%\recycler and it showed three icons. One was the standard Recycle Bin icon (S-1-5-21- ........ -1005) and the other two had standard Folder icons (S-1-5-21- ........ -1003 and S-1-5-21- ........ -500). I could open the -1005 icon and it showed all of the items in the Limited user's Recycle Bin, so I assume that -1005 refers to that account. I did not have access to open either of the other two icons so suspected that they refer to the Recycle Bin of the account with Admin rights and the built-in Administrator account.

I logged in with Admin rights and did the same. This time it showed three Recycle Bin icons, one for each of the S-1-5-21 ..., as above. I could open each one but they all demonstrated the contents of the Recycle Bin of the Admin account! Why is that? I expected the -1005 to show the contents of the Limited account Recycle Bin and either the -1003 or -500 to show the contents of the Admin account.

I opened a command screen and went to c:\recycler then each of the subdirectories S-1-5-21- ........ -1003, S-1-5-21- ........ -1005 and S-1-5-21- ........ -500. The contents of each were different and reflected correctly the contents of each Recycle Bin (the names were in the form Dc??.xxx, where ?? is a number and xxx is the extension, and I expected this).

Why can I see the contents of the Recycle Bin of each account correctly from the command screen (when logged in with Admin rights) but I can't when I use Windows Explorer? How can I gain access to see the contents correctly via Windows Explorer?

Apologies that this is a long post, but I know it's important to give full details, so meaningful responses can be given.

Thanks for reading!

 

[linney]

The probable answer is "by design", I see the same behavior even when looking at Recycle Bins from other partitions. They all point to the same one users Recycle Bin, that being the currently logged on user as in your example.


These articles are only semi-related but I include them, the last one might be of interest, but probably has no bearing on your question?

Differences Between the Recycle Bin and the Recycler Folder

http://support.microsoft.com/default.aspx?scid=kb;en-us;171694&FR=1&PA=1&SD=HSCH

How the Recycle Bin Stores Files

http://support.microsoft.com/kb/136517/EN-US/

Do not disk duplicate installed versions of Windows

http://support.microsoft.com/kb/162001/EN-US/

This article is Windows 9x related but the story of Desktop.ini and Index.dat files is pretty much applicable to XP.

http://sillydog.org/mshidden.html

 

[CondorMan]

Thank you linney. I appreciate the comment about it probably being by design! At least I can access DOS commands to see what's there and it's reassuring (in some ways) to know that I haven't missed a tweak to allow me to see them using Windows Explorer.

I see that one of the MS articles partly answers a supplementary question regarding the SIDs. It says that the built-in Administrator's SID ends with -500 and other users' SIDs end with -1000, -1001 etc. in sequence. I've ONLY ever set up two accounts, so why do the other two SIDs on my laptop end with -1003 and -1005, when they should end with -1000 and -1001? I don't know if it relates to some other accounts that seem to have been set up automatically because of other things that I've done to my laptop - I checked <net user> at the command screen and it gave me:

Administrator
<Name of my Admin account>
<Name of my Limited account>
Guest (which I've disabled)
ASPNET
HelpAssistant
IUSR_<Name of my Laptop>
IWAM_<Name of my Laptop>
SUPPORT_388945a0

Could the "gaps" in the final four characters of the SIDs relate to these "laptop-generated" accounts?

If I have many user accounts set up, is there any easy way of determining which SID refers to which account? I guess I could log in to each one in sequence and see which SID corresponds to the Recycle Bin of the currently logged user - but I just wonder if there's a more straightforward way?

Thank you again for your contribution to my personal knowledge base!

 

[linney]

Could the "gaps" in the final four characters of the SIDs relate to these "laptop-generated" accounts?

Yes, if you mean Windows generated accounts required to run the operating system correctly. Things like "NT AUTHORITY\NetworkService", "ASPNET", and "NT AUTHORITY\LocalService", would be an example.


For more information, see Well-Known Security Identifiers at the Microsoft Resource Kits Web site.

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prnc_sid_cids.asp

The Help and Support program has some information on Security Identifiers too.

 

[CondorMan]

Thank you again linney. I'd seen the information at the Microsoft Resource Kits Web site. I'll see if I can find out elsewhere about which SID relates to which account. If I'm successful, I'll post back for everyone's benefit.

 

[CondorMan]

As promised, here's the solution that I've obtained. I hope it's of benefit to someone else.

Look at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\<SID>

Check the Data in ProfileImagePath which gives the information I've ben seeking:

%SystemDrive%\Documents and Settings\<name of account>