Unknown account win11 ending with 1000
nico8715 Posted messages 2 Status Membre -
Hello, I recently bought a mini PC with Windows 11 pre-installed. I created my account using a Microsoft account. So far, everything was going well until an unknown account ending with 1000 appeared. Mine ends with 1001.
This unknown account in S1-5-21-…-1000 appears in the security tab of every application I install. There are also traces of this account in the registry. No matter how many times I delete the corresponding keys, they reappear each time.
However, with the command wmic useraccount list full, no unknown account appears. Nor do any in the users of computer management. Despite everything, the net user command does not show an unknown account but ends with errors.
Here are some photos to illustrate my point.
How can I permanently delete this unknown account? Was it a mistake on my part or hacking?
PS: I have installed Windows 11 only once.
6 réponses
Hello
You write that you have created a MS account, however it does not appear anywhere among the users, and it should be an administrator!
Small clarification
My account and the unknown account have exactly the same SID except for the last digit 1001 (my account) and 1000 (unknown account)
My account has administrator rights. In settings, my account is ***@*** Administrator
Apart from deleting the unknown account in security for each folder, is there nothing else to do?
What's strange is that with each new application installation, this unknown account reappears.
There is no reason for the account in question to have rights to freshly installed programs since the issue arises precisely from the fact that it no longer exists, unless by some twist the local PC account is set up with a Microsoft account that does not correspond to the one known by the Microsoft server, in which case an old one is then retrieved.
A vicious reason that is mentioned here could be somewhat external to the PC where a Cloud or synchronization software existing on the previous PC (in the case of Dropbox) may have retained the old credentials.
https://answers.microsoft.com/en-us/windows/forum/all/old-sid-causing-issues-with-file-permissions/4fb0556c-4965-4046-9c5a-9b173b8fdb67
Another sneaky reason could be that the license for this PC is an official volume license or not, where formally speaking, the rights owner is that organization.
What happens if we want it, turn this PC into a local account, and then delete the guilty SID in the registry (checking beforehand that there isn't also an exotic user in AppData)?
Hello,
The 100X accounts still exist in Windows and the registry but are usually associated with their familiar name; if they are displayed in full, it is because Windows cannot associate them with an account because that account has been deleted, but some objects still retain a right of ownership or use.
Therefore, in system properties-advanced, you need to delete the offending account for each object, which can only be done by modifying the owner if it is still the old account.
https://answers.microsoft.com/fr-fr/windows/forum/all/compte-inconnu-s-1-5-21-221xxxxxxx-xxxxxxxxxx/d3f32371-4e14-4b13-9abd-a2bcd38a05da