@Bob looks like it's copying. I might post the question at some point and let you know and then you can write an answer, could be a short answer, and I can expand on it if need be, and accept it.
I think that q n a could be useful to people.
i could post the q and the a myself if you prefer, but you deserve some added rep for that and you answered it so I can let you know when/if I post it. Or rather.. I could post the Q and A, then you post an A and i'll accept yours.
@DavidPostill Honestly, I think that question smells like a troll. I mean, a virus on one device, yeah, but in all devices that have firmware? And what would even be the point of a virus that breaks so much?
Stage 1: Examining basic file system structure ...
214016 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.
Stage 2: Examining file name linkage ...
Correcting error in index $I30 for file 5.
CHKDSK discovered free space marked as allocated in the bitmap for index $I30 for file 5.
Sorting index $I30 in file 5.
Progress: 214183 of 228936 done; Stage: 93%; Total: 0%; ETA: 141:00:16
I am digging through a server's GPO objects, and I am finding references to accounts that only show up as SIDs. Typically when I see this it is an explicit setting that someone set for an account somewhere, then deleted the account or group, but not the references. And that has almost always meant Safe to delete
If it were a file ACL or whatnot I would not think twice about it, but in this case I am not sure like attached
I figured they would cause no harm, I am more afraid of having to research what they all once were or might have been, or just assuming they are dead, so if they were not hurting anything there, they should hurt not more gone.
yeah, someone got happy with them for sure, from what I have worked through thus far, over half is obsolete anyway in the current environment.
Yes, I assumes they were service accounts, and probably detritus from the manually excised link/exchange server that once used to be in the domain (but not uninstalled, just turned of and manually hacked out)