Windows 10: Account Unknown has full Security permissions on my own User - huh?

Account Unknown(S-1-5-21-1345748419-2493160549-2943627078-1000)
has full permissions in the "Advanced Security Settings" for my own user account on my Win 10 Pro 64-bit PC.
What is it? Is this normal?

If I go to C:\Users\ , it lists four users:
[Myself]
Default
Default.migrated
Public.

If I right-click on [Myself] and hit Properties, then go to the security tab, it lists four "Group or user names:" with certain Permissions:
SYSTEM with full permissions - all items checked
Account Unknown(S-1-5-21-1345748419-2493160549-2943627078-1000) with the same full permissions - all items checked
[Myself] with the same full permissions - all items checked
Administrators with the same full permissions - all items checked

What is the Account Unknown(S-1-5-21-1345748419-2493160549-2943627078-1000), and how did it get there?

Two clues:
1) My PC is dual-booting Win 7 Pro 64-bit and this Win 10 Pro 64-bit. I'm in the Win 10
2) 15 minutes ago (and before checking this), I turned on Public file sharing so other PCs on my home network could see any documents I put in those Public folders or maybe vice versa. I do NOT have "Homegroup" turned on.

But wha' happening here?

:)

 

Error code 0xA00F424F(0x80004005) when i try to use camera

Hi Robert,

The System account and my account both have all of the permissions checked. There's also an Account Unknown (S-1-5-21- a lot more numbers) that only has some permissions checked (Read & execute, List folder contents, Read). Home users has only partial permissions
and Administrator has full permissions.

 

user properties

I am trying to delete an old user folder and an unknown account (has full permission and is preventing me)

 

Hello glnz, *Smile

You will see "Account Unknown" for an account that is not currently available. This could be from an account you deleted that had permissions, or from an account on another computer that is not connected.

Either way, it's safe to remove any listed "Account Unknown" entries in permissions if you are sure it's for an account that will no longer need permissions for the item.

 

Brink - thanks for suggestion.
But I'm not sure about this at all.
By the way, if I open a cmd and do the wmic (or wimc?) command to show all the accounts, this unknown one does not appear!
What's the worst that could happen if I delete this unknown account from the security tab?

 

If it's not listed in the Registry, it may also be from a previous installation.

 

"Account Unknown" is not an actual user account, but only a marker for an account that has either been deleted or not currently available/connected. It basically is saying that the long SID number is no longer associated with an account, thus "Account Unknown".

Removing "Account Unknown" from permissions will only affect the account it was for. If that account has been deleted, then there's nothing to worry about.

 

Edwin - good catch. The Account Unknown SID does NOT appear under HKEY_USERS in Win 10.

HOWEVER, as I said, my PC is dual-booting Win 7 Pro 64-bit and Win 10 Pro 64-bit. Guess what? My Account Unkown SID DOES appear under HKEY_USERS if I reboot into Win 7 !!! And that SID is my own user in Win 7 !!!

Now, in Win 7, I have two different Account Unknowns. I betcha they are from my Win 10 (and maybe its predecessor, my old Win 8/8.1.)

Stay tuned.

Thanks to you both for helping me find this.

 

That indicates that you are accessing the file from your account on the other OS, and is why you get "Account unknown" for that account.

 

Brink - yes, that makes sense.

 

And, don't forget to make routine OS and data partition backups, in case Windows decides to "go broke".

 

and if its listed in the registry like in my case then what? *Redface

 

Hello Loque, *Smile

That is a list of SIDs for accounts on your computer.

Please provide more details about your issue.

 

Howdy!
Here are the details:
I had some issues with my windows 10: Unable to access boot device and trying to fix that issue i thought that it's a case of malware going on my PC and started looking through solutions and files when i have noticed that in my security tab under desktop items i have plenty of Users with full or special access named: S1-5-21- etc.
I have tried removing the users on whats my desktop but:
1) I can't remove the users on some items.
2) Don't really want to go through all files and folders and do this manually.
3) I have found out that by just copying an item from desktop, even a photo, to another location on the drive except C: when checking on the security tab those users are gone.
I have attached some photos showing this. One of it is for avira DNS where i have extra permission entries than the usual.
I have also added a photo with the reg key for admins.
My general concern is that there is a hacker account with permission on my desktop items so it can steal my passwords and accounts!

Software Details :
- I have avira PRO bought and running and scanned for viruses and rootkit scan. All clean!
- I have adware running and scanned for malware, found some Pup. Optional. Legacy as showing in one of the 5 photos.
- Drivers up to date for video card.
- OS Version: Windows 10 64bit N. Yes the legal version.
- CCleaner lates free version, running on a weekly basis.
- Spybot search and destroy running again regularly.

Hardware details:
- 120 Intel ssd drive windows dedicated only.
- Intel i7 4790k OC to 4.4
- Asus Mobo z97 Chipset
- Gtx 10 80 ti MSI GPU
- 16 Gb DDR 3 memory 2400 Mhz
- Additional 1 TB SSD for games
- 2 SSHD for contenct creation
- 1 TB HDD For data.

Photos:











Hope this helps!

 

loque,

An "unknown" in permissions is usually from an account that had accessed it, but the account is no longer available for whatever reason (ex: deleted account, accessed from another computer).

You can use Option Two in the tutorial below to get more specific details about the accounts on your computer to see if anything stands out in the report.

*Arrow View User Account Details in Windows 10 User Accounts Tutorials