Windows 10: Unknown accounts ?

  1.    30 Sep 2016 #1

    Unknown accounts ?


    On several fresh W10 (HOME and PRO) installations, while tweaking permissions, an "unknown account " is listed in addition to the usual Trusted Installer, Administrators, Users, System, etc.

    It's understood that 'S' accounts are security descriptors, and most are shown as, simply, S-1-xx-x-xxxx and so forth. Here's an example of an "unknown" as copied from permissions settings...

    Account Unknown(S1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-
    4053264122-3456934681)

    I don't believe that those are functional, and often they can be removed seemingly without negative consequences.
    The underlying query is: why are they created?
      My ComputerSystem Spec

  2.    30 Sep 2016 #2

    Your description of the SID structure is correct (S-1-xx-x-xxxx) but your Account unknown S1-15-3-etc doesn't look right..

    A typo perhaps? [MS-DTYP]: Well-Known SID Structures

    S-1-15 is "ALL APPLICATION PACKAGES" which is a security principal used for UWP app packages (Edge, Cortana and so on). You need it and shouldn't delete it.

    If you really have something S1-15xxxxxx then I don't know what that could be.
      My ComputerSystem Spec

  3.    30 Sep 2016 #3

    Yup, that's a direct and accurate paste. I've run across these when changing permissions for Immersive Shell, Shell Service Host and the like. Others show no such "unknown." Thanks for the insight.
      My ComputerSystem Spec

  4.    30 Sep 2016 #4

    If you have something S1-15-3-1024 it looks too much like the S-1-15-3-1024 that I have to be a coincidence. Someone else's typo I guess

    You could scan through the registry and have a look.. Considering you see it changing permissions on Immersive Shell (which is for the UWP apps) then as long as you can see ALL APPLICATION PACKAGES as a principal my guess it isn't required and you can delete it.

    There is a bug where you sometimes get a user called defaultuser0 created on clean install but it has a SID of S-1-21-something and can be safely ignored also. At least I am.
      My ComputerSystem Spec

  5.    30 Sep 2016 #5

    The Laptop HOME version has Defaultuser(). Viewing the laptop's registry Profile List, Defaultuser() is there as well.

    Messing with that profile may affect Windows Updates. That appeared to be the case here when Defaultuser() was removed from the USERS folder, and the 9/29 cumulative update twice failed. After restoring the profile from the recycle bin, the update succeeded.

    Earlier, when Defaultuser() was removed from the USERS folder in File Manager, Windows update failed (twice) to install the latest cumulative update. It succeeded after the Defaultuser() account was restored from the recycle bin. Related? Perhaps...

    ** UPDATED INFO **
    However, weeks later - after creating an image of the partition, a restore point, and a recovery drive - Defaultuser() was again deleted from the USERS folder and from the Profile list in the registry. A subsequent update (10/11) succeeded.

    This thread
    may hint at a relationship between Defaultuser() - or Defaultuser0 on some machines - and the elusive 'unknown' profiles are discussed extensively there.

    In any case, but for one user's conjecture to the contrary, it appears that performance doesn't suffer from these extraneous entries and that it may be best to ignore them as lx07 suggests.
    Last edited by borgus; 11 Oct 2016 at 16:10.
      My ComputerSystem Spec

  6. maryg's Avatar
    Posts : 7
    win10 64 build 14393.479 1.7ghz
       12 Dec 2016 #6

    Cortana's SID found


    In permissions, Defaultuser0 is shared and password protected! Shared with whom? How do i find out? There is no indication of a share when i click on advanced.
    Could this account be Cortana?
    Cortana and dfu0 are not the same. Here is what I found to be Cortana's SID:
    S-1-15-2-1861897761-1695161497...
    Message me if you require the complete SID or you find it wrong.
    Last edited by maryg; 13 Dec 2016 at 01:26. Reason: new info
      My ComputerSystem Spec


 

Related Threads
I've just installed Windows 10 and experimented with the Groove music player. It finds all the songs but they are tagged Unknown Artist and Unknown Album. The songs appear fine in iTunes with the correct details and album art. I reset Groove and...
Under Settings->Accounts->Your email and accounts at my email account it says: "Attention required" I am using Outlook 2013 and outlook.com (pop/smtp) I have been using the Outlook app, but replaced it with K9 Mail and removed the app from my...
Hi I'm surprised that nobody else has this problem, but I've searched and can't find an answer...apologies if I've not looked hard enough but I decided to post a question because this is 'urgent' to me. I had 2 children's accounts in Win 8,...
I was in the process of updating several sata controllers and chipset drivers. I also installed a new USB 3.0 hub and was in the process of moving around several devices between ports. I had a problem with my keyboard which uses USB 2.0 as a...
Hi there Using SIMPLE / standard File sharing connections and all computers in the LAN on the same network name e.g WORKGROUP. confusion seems rife over what user names to use when connecting to SHARES TO or FROM a machine logged on with an...
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 11:43.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums