1.    30 Sep 2016 #1
    Join Date : Jul 2015
    Posts : 149
    Windows 10

    Unknown accounts ?

    On several fresh W10 (HOME and PRO) installations, while tweaking permissions, an "unknown account " is listed in addition to the usual Trusted Installer, Administrators, Users, System, etc.

    It's understood that 'S' accounts are security descriptors, and most are shown as, simply, S-1-xx-x-xxxx and so forth. Here's an example of an "unknown" as copied from permissions settings...

    Account Unknown(S1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-

    I don't believe that those are functional, and often they can be removed seemingly without negative consequences.
    The underlying query is: why are they created?
      My ComputersSystem Spec
  2.    30 Sep 2016 #2
    Join Date : Jul 2015
    Posts : 3,964
    10 Pro

    Your description of the SID structure is correct (S-1-xx-x-xxxx) but your Account unknown S1-15-3-etc doesn't look right..

    A typo perhaps? [MS-DTYP]: Well-Known SID Structures

    S-1-15 is "ALL APPLICATION PACKAGES" which is a security principal used for UWP app packages (Edge, Cortana and so on). You need it and shouldn't delete it.

    If you really have something S1-15xxxxxx then I don't know what that could be.
      My ComputerSystem Spec
  3.    30 Sep 2016 #3
    Join Date : Jul 2015
    Posts : 149
    Windows 10
    Thread Starter

    Yup, that's a direct and accurate paste. I've run across these when changing permissions for Immersive Shell, Shell Service Host and the like. Others show no such "unknown." Thanks for the insight.
      My ComputersSystem Spec
  4.    30 Sep 2016 #4
    Join Date : Jul 2015
    Posts : 3,964
    10 Pro

    If you have something S1-15-3-1024 it looks too much like the S-1-15-3-1024 that I have to be a coincidence. Someone else's typo I guess

    You could scan through the registry and have a look.. Considering you see it changing permissions on Immersive Shell (which is for the UWP apps) then as long as you can see ALL APPLICATION PACKAGES as a principal my guess it isn't required and you can delete it.

    There is a bug where you sometimes get a user called defaultuser0 created on clean install but it has a SID of S-1-21-something and can be safely ignored also. At least I am.
      My ComputerSystem Spec
  5.    30 Sep 2016 #5
    Join Date : Jul 2015
    Posts : 149
    Windows 10
    Thread Starter

    The Laptop HOME version has Defaultuser(). Viewing the laptop's registry Profile List, Defaultuser() is there as well.

    Messing with that profile may affect Windows Updates. That appeared to be the case here when Defaultuser() was removed from the USERS folder, and the 9/29 cumulative update twice failed. After restoring the profile from the recycle bin, the update succeeded.

    Earlier, when Defaultuser() was removed from the USERS folder in File Manager, Windows update failed (twice) to install the latest cumulative update. It succeeded after the Defaultuser() account was restored from the recycle bin. Related? Perhaps...

    ** UPDATED INFO **
    However, weeks later - after creating an image of the partition, a restore point, and a recovery drive - Defaultuser() was again deleted from the USERS folder and from the Profile list in the registry. A subsequent update (10/11) succeeded.

    This thread
    may hint at a relationship between Defaultuser() - or Defaultuser0 on some machines - and the elusive 'unknown' profiles are discussed extensively there.

    In any case, but for one user's conjecture to the contrary, it appears that performance doesn't suffer from these extraneous entries and that it may be best to ignore them as lx07 suggests.
    Last edited by borgus; 11 Oct 2016 at 16:10.
      My ComputersSystem Spec
  6.    12 Dec 2016 #6
    Join Date : Dec 2016
    Posts : 7
    win10 64 build 14393.479 1.7ghz

    Cortana's SID found

    In permissions, Defaultuser0 is shared and password protected! Shared with whom? How do i find out? There is no indication of a share when i click on advanced.
    Could this account be Cortana?
    Cortana and dfu0 are not the same. Here is what I found to be Cortana's SID:
    Message me if you require the complete SID or you find it wrong.
    Last edited by maryg; 13 Dec 2016 at 01:26. Reason: new info
      My ComputerSystem Spec


Similar Threads
Thread Forum
Solved Groove Shows Unknown Artist & Unknown Album
I've just installed Windows 10 and experimented with the Groove music player. It finds all the songs but they are tagged Unknown Artist and Unknown Album. The songs appear fine in iTunes with the correct details and album art. I reset Groove and...
Software and Apps
Accounts-Your email and accounts: Attention required - but what?
Under Settings->Accounts->Your email and accounts at my email account it says: "Attention required" I am using Outlook 2013 and outlook.com (pop/smtp) I have been using the Outlook app, but replaced it with K9 Mail and removed the app from my...
User Accounts and Family Safety
Solved How to copy user accounts in Win8 to online accounts in Win10
Hi I'm surprised that nobody else has this problem, but I've searched and can't find an answer...apologies if I've not looked hard enough but I decided to post a question because this is 'urgent' to me. I had 2 children's accounts in Win 8,...
User Accounts and Family Safety
Unknown Partition - Unknown File System - Cannot edit or remove!
I was in the process of updating several sata controllers and chipset drivers. I also installed a new USB 3.0 hub and was in the process of moving around several devices between ports. I had a problem with my keyboard which uses USB 2.0 as a...
Drivers and Hardware
W10 connections FROM and TO Ms accounts (Mix of LOCAL and MS accounts)
Hi there Using SIMPLE / standard File sharing connections and all computers in the LAN on the same network name e.g WORKGROUP. confusion seems rife over what user names to use when connecting to SHARES TO or FROM a machine logged on with an...
Network and Sharing
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 21:17.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App

Windows 10 Forums