Unknown accounts ?


  1. Posts : 234
    Windows 10
       #1

    Unknown accounts ?


    On several fresh W10 (HOME and PRO) installations, while tweaking permissions, an "unknown account " is listed in addition to the usual Trusted Installer, Administrators, Users, System, etc.

    It's understood that 'S' accounts are security descriptors, and most are shown as, simply, S-1-xx-x-xxxx and so forth. Here's an example of an "unknown" as copied from permissions settings...

    Account Unknown(S1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-
    4053264122-3456934681)

    I don't believe that those are functional, and often they can be removed seemingly without negative consequences.
    The underlying query is: why are they created?
      My Computers


  2. Posts : 5,478
    2004
       #2

    Your description of the SID structure is correct (S-1-xx-x-xxxx) but your Account unknown S1-15-3-etc doesn't look right..

    A typo perhaps? [MS-DTYP]: Well-Known SID Structures

    S-1-15 is "ALL APPLICATION PACKAGES" which is a security principal used for UWP app packages (Edge, Cortana and so on). You need it and shouldn't delete it.

    If you really have something S1-15xxxxxx then I don't know what that could be.
      My Computer


  3. Posts : 234
    Windows 10
    Thread Starter
       #3

    Yup, that's a direct and accurate paste. I've run across these when changing permissions for Immersive Shell, Shell Service Host and the like. Others show no such "unknown." Thanks for the insight.
      My Computers


  4. Posts : 5,478
    2004
       #4

    If you have something S1-15-3-1024 it looks too much like the S-1-15-3-1024 that I have to be a coincidence. Someone else's typo I guess

    You could scan through the registry and have a look.. Considering you see it changing permissions on Immersive Shell (which is for the UWP apps) then as long as you can see ALL APPLICATION PACKAGES as a principal my guess it isn't required and you can delete it.

    There is a bug where you sometimes get a user called defaultuser0 created on clean install but it has a SID of S-1-21-something and can be safely ignored also. At least I am.
      My Computer


  5. Posts : 234
    Windows 10
    Thread Starter
       #5

    The Laptop HOME version has Defaultuser(). Viewing the laptop's registry Profile List, Defaultuser() is there as well.

    Messing with that profile may affect Windows Updates. That appeared to be the case here when Defaultuser() was removed from the USERS folder, and the 9/29 cumulative update twice failed. After restoring the profile from the recycle bin, the update succeeded.

    Earlier, when Defaultuser() was removed from the USERS folder in File Manager, Windows update failed (twice) to install the latest cumulative update. It succeeded after the Defaultuser() account was restored from the recycle bin. Related? Perhaps...

    ** UPDATED INFO **
    However, weeks later - after creating an image of the partition, a restore point, and a recovery drive - Defaultuser() was again deleted from the USERS folder and from the Profile list in the registry. A subsequent update (10/11) succeeded.

    This thread
    may hint at a relationship between Defaultuser() - or Defaultuser0 on some machines - and the elusive 'unknown' profiles are discussed extensively there.

    In any case, but for one user's conjecture to the contrary, it appears that performance doesn't suffer from these extraneous entries and that it may be best to ignore them as lx07 suggests.
    Last edited by borgus; 11 Oct 2016 at 16:10.
      My Computers


  6. Posts : 6
    win10 64 build 14393.479 1.7ghz
       #6

    Cortana's SID found


    In permissions, Defaultuser0 is shared and password protected! Shared with whom? How do i find out? There is no indication of a share when i click on advanced.
    Could this account be Cortana?
    Cortana and dfu0 are not the same. Here is what I found to be Cortana's SID:
    S-1-15-2-1861897761-1695161497...
    Message me if you require the complete SID or you find it wrong.
    Last edited by maryg; 13 Dec 2016 at 01:26. Reason: new info
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 13:28.
Find Us




Windows 10 Forums