Windows 10: Unknown accounts ?

On several fresh W10 (HOME and PRO) installations, while tweaking permissions, an "unknown account " is listed in addition to the usual Trusted Installer, Administrators, Users, System, etc.

It's understood that 'S' accounts are security descriptors, and most are shown as, simply, S-1-xx-x-xxxx and so forth. Here's an example of an "unknown" as copied from permissions settings...

Account Unknown(S1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-
4053264122-3456934681)

I don't believe that those are functional, and often they can be removed seemingly without negative consequences.
The underlying query is: why are they created?

:)

 

Account Unknown Account in Permissions for Documents Folder

I have three unknown accounts showing in the Document Folder Permissions.

1. Account Unknown s-1-15-3-3469964869-263285312-1618360021

2. Account Unknown S-1-15-3-3624951433-212565781-4-142318126

3. Account Unknown S-1-15-3-79541342-518727559-4289142326

4. Account Unknown S-1-15-3-4096

These account cannot be deleted. How do you get rid of them

 

merge unknown user account(s)

hi,

While reinstalling some programs I came across and unknown account, also the admin account and an account with the same name.

is it possible to merge all those, or delete the unknown account.

Previously I have never seen an unknown account while looking at permissions (not that it or they were not there)

Thanks bruce

 

Your description of the SID structure is correct (S-1-xx-x-xxxx) but your Account unknown S1-15-3-etc doesn't look right..

A typo perhaps? [MS-DTYP]: Well-Known SID Structures

S-1-15 is "ALL APPLICATION PACKAGES" which is a security principal used for UWP app packages (Edge, Cortana and so on). You need it and shouldn't delete it.

If you really have something S1-15xxxxxx then I don't know what that could be.

 

Yup, that's a direct and accurate paste. I've run across these when changing permissions for Immersive Shell, Shell Service Host and the like. Others show no such "unknown." Thanks for the insight.

 

If you have something S1-15-3-1024 it looks too much like the S-1-15-3-1024 that I have to be a coincidence. Someone else's typo I guess *Wink

You could scan through the registry and have a look.. Considering you see it changing permissions on Immersive Shell (which is for the UWP apps) then as long as you can see ALL APPLICATION PACKAGES as a principal my guess it isn't required and you can delete it.

There is a bug where you sometimes get a user called defaultuser0 created on clean install but it has a SID of S-1-21-something and can be safely ignored also. At least I am.

 

The Laptop HOME version has Defaultuser(). Viewing the laptop's registry Profile List, Defaultuser() is there as well.

Messing with that profile may affect Windows Updates. That appeared to be the case here when Defaultuser() was removed from the USERS folder, and the 9/29 cumulative update twice failed. After restoring the profile from the recycle bin, the update succeeded.

Earlier, when Defaultuser() was removed from the USERS folder in File Manager, Windows update failed (twice) to install the latest cumulative update. It succeeded after the Defaultuser() account was restored from the recycle bin. Related? Perhaps...

** UPDATED INFO **
However, weeks later - after creating an image of the partition, a restore point, and a recovery drive - Defaultuser() was again deleted from the USERS folder and from the Profile list in the registry. A subsequent update (10/11) succeeded.

This thread may hint at a relationship between Defaultuser() - or Defaultuser0 on some machines - and the elusive 'unknown' profiles are discussed extensively there.

In any case, but for one user's conjecture to the contrary, it appears that performance doesn't suffer from these extraneous entries and that it may be best to ignore them as lx07 suggests.

 

In permissions, Defaultuser0 is shared and password protected! Shared with whom? How do i find out? There is no indication of a share when i click on advanced.
Could this account be Cortana?
Cortana and dfu0 are not the same. Here is what I found to be Cortana's SID:
S-1-15-2-1861897761-1695161497...
Message me if you require the complete SID or you find it wrong.