How do you deal with Unknown (S-1-15-3-xxxxxxxxxxxxxxxxxxxxxxxxxx)

on my Windows 11 24H2, several folders (NOT all) cannot be accessed. likely ownership taken by Unknown (S-1-15-3-xxxxxxxxxxxxxxxxxxxxxxxxxx)



In past, I had removed the Unknown accounts, re-taken over ownership. That fixed the access problem.
As Windows 24H2 is new, so I did google to see if any "improved" solution. it's noticed that answers.microsoft.com had this posted



--- Windows creates hidden security accounts in the background of the operating system, they all begin with S-1-15-XXXX, all Windows systems have those accounts, they are used for administrative tasks like Windows Security, installing updates, file management...etc. those accounts are normal and rest assured you have nothing to worry about, you should never try to remove those hidden accounts.

I am a little shocked by the statement above.

1. This is a hostile takeover by Windows and Microsoft tries to hide it?
2. Even you have noticed by chance, --- you should never try to remove those hidden accounts.

I hope to restore access to those folders. would like to know how you guys deal with this case.
"never try to remove those hidden accounts." ? then these must be a proper way.
(indeed, as long as the folder was shared in past. while PC got new OS installed (no matter W7/10/11). this problem always happened)

I found out to my cost that you can't mess with them.

Anyway, I removed them on my data partitions (like I did before). now access of those folders has been restored.

I didn't do it on OS partition, OS folders can be sensitive.

I have a fresh backup, so...
I removed Unknown (S-1-15-3-xxxxxxxxxxxxxxxxxxxxxxxxxx) on my OS partition, rebooted, and it just grew back.

Ghot said:

I have a fresh backup, so...
I removed Unknown (S-1-15-3-xxxxxxxxxxxxxxxxxxxxxxxxxx) on my OS partition, rebooted, and it just grew back.

Click to expand...

I once tried that and had to do a re-install, Windows exploded.

Rollback_Jockey said:

I once tried that and had to do a re-install, Windows exploded.

Click to expand...

I had that happen once...





Not really.

siliconbeaver said:

--- Windows creates hidden security accounts in the background of the operating system, they all begin with S-1-15-XXXX, all Windows systems have those accounts, they are used for administrative tasks like Windows Security, installing updates, file management...etc. those accounts are normal and rest assured you have nothing to worry about, you should never try to remove those hidden accounts.

I am a little shocked by the statement above.

1. This is a hostile takeover by Windows and Microsoft tries to hide it?
2. Even you have noticed by chance, --- you should never try to remove those hidden accounts

Click to expand...

1. When you perform a clean install, Windows creates a random SID (Security Identifier) for the entire system. This randomized SID is designed to make this PC unique, and distinct from all other PC's in the universe. Every time you re-install Windows on this exact same PC, a different SID will be created for the system. It's a designed security feature.

2. After the system SID is generated, Windows creates a series of default user for its own use. Some of the pre-defined user profiles have a SID derivated from the system's SID, by appending the last few digits. There is a hierarchy of which SID's are pre-assigned to either "well known SID's" which have fixed ID numbers, and those that are derived by appending.

3. The first legitimate user account is assigned the SID with S-.-.-.-1000. Every new user is assigned the next available number (1001, 1002...).

4. If you have folders or files created by a previous Windows install (or transferred from another PC), their SID's will have wildly different numbers. Again, because those folders were made on a PC with a different random SID. Since your PC doesn't recognize the SID numbers, it's treated as "Unknown User". While you can take ownership of these files so you have control, that action doesn't clear the other SID from the file's security info. You have to perform the additional step of updating the security info, and explicitly removing that SID.

5. Folks who've reinstalled their Windows over and over, but left their external drives untouched will always see this problem. System SID's are not interchangeable, you can't import the previous Windows' SID into your new Windows. It doesn't work that way for security reasons.

Thanks,

unique

That's right like NIC MAC address or phone's IMEI number. I see.

garlin said:

1. This randomized SID is designed to make this PC unique, and distinct from all other PC's in the universe. Every time you re-install Windows on this exact same PC, a different SID will be created for the system. It's a designed security feature.

Click to expand...