Solved "Other users" present in lock screen of W11 enterprise but no idea who's account


mystvearn

Well-known member
Local time
11:12 PM
Posts
23
OS
Windows 11 Enterprise
I found this when I locked my windows, but no idea who it is. Not available under my accounts. I tried to see who it is by clicking, asked to put login details. How do I I delete this account? 20240110_082854.jpg
 
Windows Build/Version
Windows 11 enterprise

My Computers My Computers

  • At a glance

    Windows 11 EnterpriseRyzen 5 360032 GB DDR4MSI RTX 3060 12 GB
    OS
    Windows 11 Enterprise
    Computer type
    PC/Desktop
    Manufacturer/Model
    Own built
    CPU
    Ryzen 5 3600
    Motherboard
    Gigabyte Auros B550M
    Memory
    32 GB DDR4
    Graphics Card(s)
    MSI RTX 3060 12 GB
    Sound Card
    on board
    Monitor(s) Displays
    Dell U2713HM, Dell U2715H, 1080p philips monitor
    Screen Resolution
    2560x1440*2
    Hard Drives
    1
    PSU
    650W
  • At a glance

    Windows 11 Proi7 9750H16 GBGTX 1650
    Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell G3 3590
    CPU
    i7 9750H
    Memory
    16 GB
    Graphics card(s)
    GTX 1650
    Hard Drives
    1 TB Toshiba, 240GB Koxia
Sometimes a clean Windows install will experience errors during the Out of Box Experience (OOBE), and fail to remove the temporary user defaultuser0. This remnant shows up as "Other user" on the logon screen.

It's most harmless, you can't logon on this account.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Open Regedit and go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Right click on the ProfileList key and select Export before you make any changes. If things do not go to plan, you can restore the key using your exported .reg file.

Look for a Default0 user. If it is present then delete it.

The ProfileList key should look like this:
1704849741839.png

Note:
The S-1-5-18 is the system profile.
The S-1-5-19 is the Local Service profile.
The S-1-5-20 is the Network Service profile.
The S-1-5-21-3509888341-461846594-3914475199-1001 key should be your user name profile. Enter the key and check the ProfileImagePath to be sure.
The S-1-5-21-3509888341-461846594-3914475199-500 key is for the Administrator account, which I have enabled. It should not be present if you have NOT enabled the Administrator account.

HTH
 

My Computer My Computer

At a glance

Windows 11 ProRyzen 9 3900XG-Skill RipjawsV F4-3600C18 (16GB x 2)Gigabyte RX 5700 XT Gaming OC
OS
Windows 11 Pro
Computer type
PC/Desktop
CPU
Ryzen 9 3900X
Motherboard
ASUS ROG Strix X570-E Gaming
Memory
G-Skill RipjawsV F4-3600C18 (16GB x 2)
Graphics Card(s)
Gigabyte RX 5700 XT Gaming OC
Sound Card
Realtek ALC1220P
Monitor(s) Displays
ASUS VE278 (x 2)
Screen Resolution
1920x1080
Hard Drives
Samsung 850 Pro 256GB
Samsung 970 Pro NVMe 512GB (x 2)
ST10000VN0004 10TB (x 2)
ST10000VN0008 10TB (x 2)
ST4000VN000 4TB (x 2)
PSU
Corsair HX1000
Case
Corsair Carbide 400R
Cooling
AMD Wraith Prism (Stock)
Keyboard
Logitech G213
Mouse
Logitech G502
Internet Speed
100Mbps down / 40Mbps up
Browser
Firefox - Chrome - Edge
Antivirus
Windows Defender - Clamwin
Note:
The S-1-5-18 is the system profile.
The S-1-5-19 is the Local Service profile.
The S-1-5-20 is the Network Service profile.
The S-1-5-21-3509888341-461846594-3914475199-1001 key should be your user name profile. Enter the key and check the ProfileImagePath to be sure.
The S-1-5-21-3509888341-461846594-3914475199-500 key is for the Administrator account, which I have enabled. It should not be present if you have NOT enabled the Administrator account.

HTH
I found the folders as mentioned. The long one is my own user account. What do you mean by enable? How to know what is/what is not enabled? When I right click and modify the ProfileImagePath, I see my username. What should I do next since the "Other users" is still there.

I do not see the "other users" there. Previously, I got this error in login details.
Screenshot_20240110_100145_WhatsApp.jpg

I checked the certificates, I found this
Screenshot_20240110_100315_WhatsApp.jpg

While the SSO_POP_Username is my personal email address, the username shown is not any of my known usernames. After removing the certificates, I no longer get the windows login reminder.
 

My Computers My Computers

  • At a glance

    Windows 11 EnterpriseRyzen 5 360032 GB DDR4MSI RTX 3060 12 GB
    OS
    Windows 11 Enterprise
    Computer type
    PC/Desktop
    Manufacturer/Model
    Own built
    CPU
    Ryzen 5 3600
    Motherboard
    Gigabyte Auros B550M
    Memory
    32 GB DDR4
    Graphics Card(s)
    MSI RTX 3060 12 GB
    Sound Card
    on board
    Monitor(s) Displays
    Dell U2713HM, Dell U2715H, 1080p philips monitor
    Screen Resolution
    2560x1440*2
    Hard Drives
    1
    PSU
    650W
  • At a glance

    Windows 11 Proi7 9750H16 GBGTX 1650
    Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell G3 3590
    CPU
    i7 9750H
    Memory
    16 GB
    Graphics card(s)
    GTX 1650
    Hard Drives
    1 TB Toshiba, 240GB Koxia
In order to use the Administrator account, you must open a Power Shell window and enter a command to enable it.
Get-LocalUser -Name “Administrator” | Enable-LocalUser

To disable the Administrator account, enter:
Get-LocalUser -Name “Administrator” | Disable-LocalUser

I would run a malware/virus scan on your machine, just to be on the safe side, especially if you did not add that certificate etc...
 

My Computer My Computer

At a glance

Windows 11 ProRyzen 9 3900XG-Skill RipjawsV F4-3600C18 (16GB x 2)Gigabyte RX 5700 XT Gaming OC
OS
Windows 11 Pro
Computer type
PC/Desktop
CPU
Ryzen 9 3900X
Motherboard
ASUS ROG Strix X570-E Gaming
Memory
G-Skill RipjawsV F4-3600C18 (16GB x 2)
Graphics Card(s)
Gigabyte RX 5700 XT Gaming OC
Sound Card
Realtek ALC1220P
Monitor(s) Displays
ASUS VE278 (x 2)
Screen Resolution
1920x1080
Hard Drives
Samsung 850 Pro 256GB
Samsung 970 Pro NVMe 512GB (x 2)
ST10000VN0004 10TB (x 2)
ST10000VN0008 10TB (x 2)
ST4000VN000 4TB (x 2)
PSU
Corsair HX1000
Case
Corsair Carbide 400R
Cooling
AMD Wraith Prism (Stock)
Keyboard
Logitech G213
Mouse
Logitech G502
Internet Speed
100Mbps down / 40Mbps up
Browser
Firefox - Chrome - Edge
Antivirus
Windows Defender - Clamwin
In order to use the Administrator account, you must open a Power Shell window and enter a command to enable it.
Get-LocalUser -Name “Administrator” | Enable-LocalUser

To disable the Administrator account, enter:
Get-LocalUser -Name “Administrator” | Disable-LocalUser

I would run a malware/virus scan on your machine, just to be on the safe side, especially if you did not add that certificate etc...
When I run the code, I get:

Enable-LocalUser : Access denied. At line:1 char:40 + Get-LocalUser -Name “Administrator” | Enable-LocalUser + ~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (Administrator:LocalUser) [Enable-LocalUser], AccessDeniedException + FullyQualifiedErrorId : AccessDenied,Microsoft.PowerShell.Commands.EnableLocalUserCommand

My IT department also told me to run that. I did follow these steps until removing the certificates.

I did run malwarebytes-all clear. Eset AV, all clear.
 

My Computers My Computers

  • At a glance

    Windows 11 EnterpriseRyzen 5 360032 GB DDR4MSI RTX 3060 12 GB
    OS
    Windows 11 Enterprise
    Computer type
    PC/Desktop
    Manufacturer/Model
    Own built
    CPU
    Ryzen 5 3600
    Motherboard
    Gigabyte Auros B550M
    Memory
    32 GB DDR4
    Graphics Card(s)
    MSI RTX 3060 12 GB
    Sound Card
    on board
    Monitor(s) Displays
    Dell U2713HM, Dell U2715H, 1080p philips monitor
    Screen Resolution
    2560x1440*2
    Hard Drives
    1
    PSU
    650W
  • At a glance

    Windows 11 Proi7 9750H16 GBGTX 1650
    Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell G3 3590
    CPU
    i7 9750H
    Memory
    16 GB
    Graphics card(s)
    GTX 1650
    Hard Drives
    1 TB Toshiba, 240GB Koxia
Did you open Power Shell 'As Administrator' ?

I probably should have mentioned that earlier :(

That certificate was more than likely added by Microsoft, but I hate it when they use user names like that. They can so easily be malicious.

At least you can have some peace of mind knowing that it's not malicious now.
 

My Computer My Computer

At a glance

Windows 11 ProRyzen 9 3900XG-Skill RipjawsV F4-3600C18 (16GB x 2)Gigabyte RX 5700 XT Gaming OC
OS
Windows 11 Pro
Computer type
PC/Desktop
CPU
Ryzen 9 3900X
Motherboard
ASUS ROG Strix X570-E Gaming
Memory
G-Skill RipjawsV F4-3600C18 (16GB x 2)
Graphics Card(s)
Gigabyte RX 5700 XT Gaming OC
Sound Card
Realtek ALC1220P
Monitor(s) Displays
ASUS VE278 (x 2)
Screen Resolution
1920x1080
Hard Drives
Samsung 850 Pro 256GB
Samsung 970 Pro NVMe 512GB (x 2)
ST10000VN0004 10TB (x 2)
ST10000VN0008 10TB (x 2)
ST4000VN000 4TB (x 2)
PSU
Corsair HX1000
Case
Corsair Carbide 400R
Cooling
AMD Wraith Prism (Stock)
Keyboard
Logitech G213
Mouse
Logitech G502
Internet Speed
100Mbps down / 40Mbps up
Browser
Firefox - Chrome - Edge
Antivirus
Windows Defender - Clamwin
My IT department also told me to run that.
Is this a work computer, or did they just give you some friendly helpful advice (sounds like a good IT department :-) )
 

My Computers My Computers

  • At a glance

    Windows 11 2xH2 (latest update ... forever anal)Intel i5-124008GBNVIDIA GeForce GT730
    OS
    Windows 11 2xH2 (latest update ... forever anal)
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP Slim S01
    CPU
    Intel i5-12400
    Memory
    8GB
    Graphics Card(s)
    NVIDIA GeForce GT730
    Sound Card
    OOBE
    Monitor(s) Displays
    Acer 32"
    Screen Resolution
    1920x1080
    Hard Drives
    512GB KIOXIA NVMe
    1TB SATA SSD
    PSU
    OOBE
    Case
    OOBE
    Cooling
    OOBE
    Keyboard
    BT
    Mouse
    BT
    Browser
    Brave FFox Chrome Opera
    Antivirus
    KIS
  • At a glance

    Windows 11 Pro 2xH2 (latest update ... 4ever ...i7-1165G7 @ 2.80GHzIntel Iris Xe Graphics
    Operating System
    Windows 11 Pro 2xH2 (latest update ... 4ever anal)
    Computer type
    Laptop
    Manufacturer/Model
    HP Pavillion 15
    CPU
    i7-1165G7 @ 2.80GHz
    Graphics card(s)
    Intel Iris Xe Graphics
    Hard Drives
    Samsung NVMe 512GB
    + numerous/multiple SSD Type C USB enclosures
    Internet Speed
    NBN FTTN 50
    Browser
    Brave
    Antivirus
    KIS
Did you open Power Shell 'As Administrator' ?

I probably should have mentioned that earlier :(

That certificate was more than likely added by Microsoft, but I hate it when they use user names like that. They can so easily be malicious.

At least you can have some peace of mind knowing that it's not malicious now.
Yes, IINM. The security division troubleshooting via virtual machines and deleted my personal account account from the login details. Hopefully it will settle the problem.
Is this a work computer, or did they just give you some friendly helpful advice (sounds like a good IT department :-) )
Yes, work pc.
 

My Computers My Computers

  • At a glance

    Windows 11 EnterpriseRyzen 5 360032 GB DDR4MSI RTX 3060 12 GB
    OS
    Windows 11 Enterprise
    Computer type
    PC/Desktop
    Manufacturer/Model
    Own built
    CPU
    Ryzen 5 3600
    Motherboard
    Gigabyte Auros B550M
    Memory
    32 GB DDR4
    Graphics Card(s)
    MSI RTX 3060 12 GB
    Sound Card
    on board
    Monitor(s) Displays
    Dell U2713HM, Dell U2715H, 1080p philips monitor
    Screen Resolution
    2560x1440*2
    Hard Drives
    1
    PSU
    650W
  • At a glance

    Windows 11 Proi7 9750H16 GBGTX 1650
    Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell G3 3590
    CPU
    i7 9750H
    Memory
    16 GB
    Graphics card(s)
    GTX 1650
    Hard Drives
    1 TB Toshiba, 240GB Koxia

Latest Support Threads

Back
Top Bottom