What causes this "Cleaning up 12 unused index entries from index $SII of file 0x9"

Question

**Why do I always get the following Information notice about "unused index entries from index" from Winlogon under Application in my Event Viewer when I do a Check Disk?Also, am I performing a "chkdsk /f" if I'm running Chkdsk by going to Windows Explorer, right clicking on my hard drive, choosing properties, Tools Tab, Error Checking , Check now and choosing both options?  (It always schedules on the next restart.)      __________________________________________**Checking file system on C:

The type of the file system is NTFS.

Volume label is SQ004207P01.

A disk check has been scheduled.

Windows will now check the disk.                        

Cleaning up 12 unused index entries from index $SII of file 0x9.Cleaning up 12 unused index entries from index $SDH of file 0x9.Cleaning up 12 unused security descriptors.

CHKDSK is verifying Usn Journal...

Usn Journal verification completed.

CHKDSK is verifying file data (stage 4 of 5)...

File data verification completed.

CHKDSK is verifying free space (stage 5 of 5)...

Free space verification is complete.

  77834893 KB total disk space.

  13842992 KB in 48756 files.

     16080 KB in 5274 indexes.

         0 KB in bad sectors.

    147953 KB in use by the system.

     65536 KB occupied by the log file.

  63827868 KB available on disk.

      4096 bytes in each allocation unit.

  19458723 total allocation units on disk.

  15956967 allocation units available on disk.

Internal Info:

00 1d 01 00 1a d3 00 00 c6 1b 01 00 00 00 00 00  ................

d4 02 00 00 03 00 00 00 7b 06 00 00 00 00 00 00  ........{.......

5a 16 c7 04 00 00 00 00 c0 19 81 1d 00 00 00 00  Z...............

32 40 93 0e 00 00 00 00 c8 f9 7c 00 02 00 00 00  2@........|.....

04 8a df 04 06 00 00 00 26 56 97 3e 08 00 00 00  ........&V.>....

99 9e 36 00 00 00 00 00 88 38 07 00 74 be 00 00  ..6......8..t...

00 00 00 00 00 c0 e8 4c 03 00 00 00 9a 14 00 00  .......L........

Windows has finished checking your disk.

Please wait while your computer restarts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Answer 1

I googled them and results of the search seemed to suggest there was some kind of security threat.  At that time the number was significantly higher than 12.  (in the 80s and 50s.)  I thought maybe the words "security descriptors"  should concern me. 

No, it's not really a threat.  Security Descriptors are where the permissions are stored, these permissions control who can and who cannot get access to the 'object' in question.  Unused security descriptors means just that, descriptors that are not used.  The files may no longer be present or the descriptor may be otherwise orphaned, people like everything to be pristine and the error message might be annoying to see but in your case it's nothing to worry about.

What Are Security Descriptors and Access Control Lists?

John

Answer 2

Just ignore these errors, there is no problem with the file system.

If you have 4 million plus files or a Master File Table greater than 4GB then there is a known problem with security descriptors and a hotfix is available for Server 2003, for Windows XP the latest Service Pack supposedly fixes this.  See here:

The CHKDSK utility incorrectly identifies and deletes in-use security descriptors

What you see is more likely the very same benign thing that Windows 2000 can also experience with chkdsk, it can be safely ignored.  See here:

Windows 2000 Chkdsk Reports Cleaning Unused Security Descriptors

John

Answer 3

Hi TommyKerans,

You will need to perform chkdsk scan with /f switch from the recovery console until you do not receive the errors.

How to install and use the Recovery Console in Windows XP

http://support.microsoft.com/kb/307654

Description of the Windows XP Recovery Console for advanced users

http://support.microsoft.com/kb/314058

Answer 4

I'm running a stand alone laptop for home use only.  It stays updated.  My OS version is XP MCE 2005 SP3 (even though it says MCE 2002 SP3 in System Properties because or an MS MCE issue).

I did run chkdsk /f booting up in safe mode with the command prompt but I still go the same "**unused index entries from index $SII of file 0x9"**thing.

Answer 5

Hi TommyKerans,

This problem occurs because the Chkdsk utility may not find references to all the security IDs if the master file table is larger than 4 gigabytes (GB) or if there are more than 4,194,303 files on the volume. Therefore, the undiscovered security descriptors are reset.

You will need to update the computer to the latest service pack for Windows XP, refer the article below for more information.

The CHKDSK utility incorrectly identifies and deletes in-use security descriptors

http://support.microsoft.com/kb/831374

---

Chkdsk requires exclusive access to a volume when it runs. Therefore, if one or more of the files are open on the disk that you want to check, Chkdsk displays a prompt asking if you want schedule the disk check for the next time that you restart your computer.

Chkdsk might take a long time to run, depending on the number of files and folders, the size of the volume, disk performance, and available system resources, such as processor and memory.

How to perform disk error checking in Windows XP

http://support.microsoft.com/kb/315265

Chkdsk

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/bootcons_chkdsk.mspx?mfr=true