Remove hidden Admin account, help


DBBG

New member
Local time
8:34 PM
Posts
7
OS
Window 11
Hello,
I'm trying clean up some files and clutter on my machine and I've been having some difficulty trying to figure out how to remove an admin account that I'm not sure I need anymore. The account is AdminDerek13500.
I don't see it any but the c/users folders, it is not listed in any of the account tools for removal.
I'm using the dwb account for daily activities and usually stay out of the built in Admin account and have another account I added as a back up if i were to get locked out, DerekAD.

What is the right way to go about removing the adminderek13500 account?

Admin005.webpadmin001.webpAdmin002.webpAdmin003.webpAdmin004.webp
 

My Computer

System One

  • OS
    Window 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI
    CPU
    I5 13500
    Motherboard
    MSI B760 Tomahawk
    Memory
    32 G ddr4
in Microsoft's infinite wisdom and because of the lack of communication in house, there are things with Administrator and Administrators, yes two separate accounts.
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Mine 1.5
    CPU
    7800X3D
    Motherboard
    ASUS B650 Tuf with wifi.
    Memory
    32gb G.Skill
    Graphics Card(s)
    4070 Ti Super
    Monitor(s) Displays
    1x Nixeus NX_EDG27, 2x Dell S2440L (16:9)
    Screen Resolution
    1440p
    Hard Drives
    C:\NVME (500GB), D:\Seagate (2TB), E:\ & F:\ SSD 990EVO (1TB)
    PSU
    Corsair HX1000i
    Case
    Phanteks Enthoo Primo w/10 140mm SP Fans
    Cooling
    Artic TF2 420
    Keyboard
    Corsair 1000
    Mouse
    Steel Series Prime Wireless
    Internet Speed
    20 MB/s
    Browser
    Firefox 64
    Antivirus
    not telling!
    Other Info
    https://i.imgur.com/aoz3vWY.jpg?2
User profiles are in registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
Each user profile has a subkey here identified by a long alphanumeric string called a Security Identifier (SID). Inside each SID subkey, the ProfileImagePath value points to the location of the user's profile folder on the hard drive.
You have to open each subkey to find the account name associated with key.

Always backup your registry before making changes.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    2x1tb Solidigm m.2 nvme /External drives 512gb Samsung m.2 sata+2tb Kingston m2.nvme
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    #1 Edge #2 Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 11 Pro 24H2 26200.8457
    Computer type
    PC/Desktop
    Manufacturer/Model
    Beelink Mini PC SER5
    CPU
    AMD Ryzen 7 6800U
    Memory
    32 gb
    Graphics card(s)
    integrated
    Sound Card
    integrated
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Crucial nvme
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    still too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender
    Other Info
    System 3 is non compliant Dell 9020 i7-4770/24gb ram Win11 PRO 26200.8457
@DTG1


I gave you ten points for filling out your computer specs. :-)
 

My Computers

System One System Two

  • OS
    Win 11 Home ♦♦♦26200.8457 ♦♦♦♦♦♦♦25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Built by Ghot® [May 2020]
    CPU
    AMD Ryzen 7 3700X
    Motherboard
    Asus Pro WS X570-ACE (BIOS 5302)
    Memory
    G.Skill (F4-3200C14D-16GTZKW)
    Graphics Card(s)
    EVGA RTX 2070 (08G-P4-2171-KR)
    Sound Card
    Realtek ALC1220P / ALC S1220A
    Monitor(s) Displays
    Dell U3011 30"
    Screen Resolution
    2560 x 1600
    Hard Drives
    2x Samsung 860 EVO 500GB,
    WD 4TB Black FZBX - SATA III,
    WD 8TB Black FZBX - SATA III,
    DRW-24B1ST CD/DVD Burner
    PSU
    PC Power & Cooling 750W Quad EPS12V
    Case
    Cooler Master ATCS 840 Tower
    Cooling
    CM Hyper 212 EVO (push/pull)
    Keyboard
    Ducky DK9008 Shine II Blue LED
    Mouse
    Logitech Optical M-100
    Internet Speed
    300/300
    Browser
    Firefox (latest)
    Antivirus
    Bitdefender Total Security
    Other Info
    Speakers: Klipsch Pro Media 2.1
  • Operating System
    Windows XP Pro 32bit w/SP3
    Computer type
    PC/Desktop
    Manufacturer/Model
    Built by Ghot® (not in use)
    CPU
    AMD Athlon 64 X2 5000+ (OC'd @ 3.2Ghz)
    Motherboard
    ASUS M2N32-SLI Deluxe Wireless Edition
    Memory
    TWIN2X2048-6400C4DHX (2 x 1GB, DDR2 800)
    Graphics card(s)
    EVGA 256-P2-N758-TR GeForce 8600GT SSC
    Sound Card
    Onboard
    Monitor(s) Displays
    ViewSonic G90FB Black 19" Professional (CRT)
    Screen Resolution
    up to 2048 x 1536
    Hard Drives
    WD 36GB 10,000rpm Raptor SATA
    Seagate 80GB 7200rpm SATA
    Lite-On LTR-52246S CD/RW
    Lite-On LH-18A1P CD/DVD Burner
    PSU
    PC Power & Cooling Silencer 750 Quad EPS12V
    Case
    Generic Beige case, 80mm fans
    Cooling
    ZALMAN 9500A 92mm CPU Cooler
    Keyboard
    Logitech Classic Keybooard 200
    Mouse
    Logitech Optical M-BT96a
    Internet Speed
    300/300
    Browser
    Firefox 3.x ??
    Antivirus
    Symantec (Norton)
    Other Info
    Still assembled, still runs. Haven't turned it on for 15 years?
Your computer name is derek13500
There is no sign of any user account called adminderek13500
The foldername Administrator.adminderek13500 is very strange.
- Have you possibly tried to rename the normally hidden & disabled Built-in Admin [the one with the username Administrator]?
- Or have you possibly experienced user profile corruption in the past?
Otherwise it looks like you used to have a user account called Administrator.adminderek13500 that no longer exists.

And don't be misled, there is no account called Administrators. That is the name of the group to which all your Admin accounts belong.

I suggest you just have a nose around the folder C:\Users\Administrator.adminderek13500 so that you can copy off any files of interest.
While you're in there, see if any files ring a bell. That folder exists for a reason & that user account Administrator.adminderek13500 existed for a reason.
Then you'll know you are ready to delete it but there's no hurry if you are unsure about how that folder came to exist.


Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 25H2 Build 26200.8037
Your computer name is derek13500
There is no sign of any user account called adminderek13500
The foldername Administrator.adminderek13500 is very strange.
- Have you possibly tried to rename the normally hidden & disabled Built-in Admin [the one with the username Administrator]?
- Or have you possibly experienced user profile corruption in the past?
Otherwise it looks like you used to have a user account called Administrator.adminderek13500 that no longer exists.

And don't be misled, there is no account called Administrators. That is the name of the group to which all your Admin accounts belong.

I suggest you just have a nose around the folder C:\Users\Administrator.adminderek13500 so that you can copy off any files of interest.
While you're in there, see if any files ring a bell. That folder exists for a reason & that user account Administrator.adminderek13500 existed for a reason.
Then you'll know you are ready to delete it but there's no hurry if you are unsure about how that folder came to exist.


Denis
@denis, It's pretty mystifying and I don't want to delete anything that shouldn't be. There is very little information stored in the profile that I can access, mostly music production vst presets and Onedrive files leftover after switching off OneDrive and the last time I accessed it was 2023, I think. All of the files are also backed up to other accounts and drives. I'm not in a huge rush to get rid of the account but I wanted to slim down the c drive before jumping to the 25h2 update. I'm just stumped as to why it doesn't show up in the control panel or settings.
Can it be deleted as a folder or is there a more involved process? I do have revo uninstaller available.
Thanks for the advice. I'm going to do some more research before deleting to get a better understanding of how my machine operates. I'm not super fluent with windows but I can make sense of things with the right tutorial or guidelines but some of this stuff is way above my level of understanding for what i use this machine for.
 

My Computer

System One

  • OS
    Window 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI
    CPU
    I5 13500
    Motherboard
    MSI B760 Tomahawk
    Memory
    32 G ddr4
Thanks to all who replied. I'll eventually figure this out.
 

My Computer

System One

  • OS
    Window 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI
    CPU
    I5 13500
    Motherboard
    MSI B760 Tomahawk
    Memory
    32 G ddr4
User profiles are in registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
Each user profile has a subkey here identified by a long alphanumeric string called a Security Identifier (SID). Inside each SID subkey, the ProfileImagePath value points to the location of the user's profile folder on the hard drive.
You have to open each subkey to find the account name associated with key.

Always backup your registry before making changes.
Thanks for that, the profile does reside in the registry along with the other user profiles as well several others, which I assume are related to hidden admin account, (The built in admin account, not the one I'm looking for)
 

Attachments

  • Admin006.webp
    Admin006.webp
    74.7 KB · Views: 1

My Computer

System One

  • OS
    Window 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI
    CPU
    I5 13500
    Motherboard
    MSI B760 Tomahawk
    Memory
    32 G ddr4
Export that entire profile registry key, then delete the profile. If there are any issues your can import it back in.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    2x1tb Solidigm m.2 nvme /External drives 512gb Samsung m.2 sata+2tb Kingston m2.nvme
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    #1 Edge #2 Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 11 Pro 24H2 26200.8457
    Computer type
    PC/Desktop
    Manufacturer/Model
    Beelink Mini PC SER5
    CPU
    AMD Ryzen 7 6800U
    Memory
    32 gb
    Graphics card(s)
    integrated
    Sound Card
    integrated
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Crucial nvme
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    still too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender
    Other Info
    System 3 is non compliant Dell 9020 i7-4770/24gb ram Win11 PRO 26200.8457
Search or Press the Windows key +R and type
sysdm.cpl and press enter. Advanced tab
Under User Profiles click the Settings button.
If that user is there select it and and press the Delete button.
 

My Computer

System One

  • OS
    Windows 11 Pro Insider 64 bit 25H2 26200.5742
    Computer type
    PC/Desktop
    Manufacturer/Model
    Gigabyte Z390 UD
    CPU
    Intel Core i7 9700K 3.60
    Motherboard
    Gigabyte Z390 UD
    Memory
    16 GB
    Graphics Card(s)
    nVidia GEForce RTX 2060 Super
    Sound Card
    onboard
    Monitor(s) Displays
    Two 27" Dell 4K monitors
    Screen Resolution
    3840 x 2160
    Hard Drives
    M.2 NVME SSD, 500 GB; Two 2TB Mechanical HDD's
    PSU
    850w PSU
    Case
    Cyberpower PC
    Cooling
    Water cooled
    Keyboard
    Backlit Cyberpower gaming keyboard
    Mouse
    Backlit Cyberpower gaming mouse
    Internet Speed
    1 GB mbps
    Browser
    Brave
    Antivirus
    Windows Security
On my computers, the SID number ending in 500 is the profile for the Built-in Admn account.


Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 25H2 Build 26200.8037
Your computer name is derek13500
There is no sign of any user account called adminderek13500
If you have a broken user profile (that doesn't allow logons), Windows will sometimes create a temp user profile as [Username].[Hostname] so you can try recovering your old profile. That's probably what happened to the built-in Administrator.

I've never seen it myself, but have read people mentioning it online.
 

My Computer

System One

  • OS
    Windows 7
I've ... read people mentioning it online
Interesting.
So there was not [as I had wondered about] a failed attempt to rename the Built-in Admin, just an incident in which it failed to logon successfully.

the profile does reside in the registry
Have you ever had a failure to log in to the Built-in Admin?
Have you ever tried to do anything unusual with that account such as, but I'm only speculating:
- linking it to an MSAccount - an attempt which it is supposed to reject?
- renaming it?
- applying a password to it?

Is there anything unusual in its properties - look in the response to the cmd
net user Administrator
Here are the properties of mine as an example. Its Full name field is empty, as it should be.
net user Administrator.webp



Denis
 
Last edited:

My Computer

System One

  • OS
    Windows 11 Home x64 Version 25H2 Build 26200.8037
Windows will sometimes create a temp user profile as [Username].[Hostname] so you can try recovering your old profile
Yep, it will append the name of the domain. If you’re not joined to AD, the computer itself is the domain of which the user is a member. If the problem happens more than once, it starts appending numbers.

Edit: I pulled these profile paths from our inventory. This person likes to do a lot of "tweaking" on devices under their control. Names changed to mask the guilty.

View attachment 149811
 
Last edited:

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Core i7-1260P
    Motherboard
    NUC12WSBi7
    Memory
    64 GB Micron PC4-25600
    Graphics Card(s)
    Intel Iris Xe Graphics
    Sound Card
    on-board Realtek HD Audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840 x 2160
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Crucial MX500 2 TB
    Antivirus
    Microsoft Defender
There's another case of Administrator.[ComputerName] at


Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 25H2 Build 26200.8037
Interesting.
So there was not [as I had wondered about] a failed attempt to rename the Built-in Admin, just an incident in which it failed to logon successfully.


Have you ever had a failure to log in to the Built-in Admin?
Have you ever tried to do anything unusual with that account such as, but I'm only speculating:
- linking it to an MSAccount - an attempt which it is supposed to reject?
- renaming it?
- applying a password to it?

Is there anything unusual in its properties - look in the response to the cmd
net user Administrator
Here are the properties of mine as an example. Its Full name field is empty, as it should be.
View attachment 149800



Denis
Mine looks similar but the account is active. Still looking in to this. I'm assuming The AdminDerek13500 is the built in account and there is a second I may have activated. The built in account is practically empty but the Administrator account has 35 gb of files sitting in it. I haven't quite had the time to fully research this yet but looking at some leads now.
 

My Computer

System One

  • OS
    Window 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI
    CPU
    I5 13500
    Motherboard
    MSI B760 Tomahawk
    Memory
    32 G ddr4
If your user profile is gone, its not really gone, its a bak. file in the registry.

Look in the Profile List Folder. Examine every entry carefully and delete the one that doesn't have a bak. extension

Rename user profile with a bak. by removing the extension.

Change the D32 ProfileImagePath VALUE data from 1 to 0. Now change STATE from 1 to 0.

Save the changes and reboot your PC. When you reach the login screen, you should be able to login to your user profile.
 
Last edited:

My Computers

System One System Two

  • OS
    Windows 11 Education For 25H2
    Computer type
    Laptop
    Manufacturer/Model
    HP ZBook G2
    CPU
    Intel® Core i7 5500u
    Motherboard
    HP
    Memory
    8 GB
    Graphics Card(s)
    Intel HD Family Graphics 5500 AMD Firepro 4150M
    Sound Card
    Realtek High Audio
    Hard Drives
    1 TB SSD
    Mouse
    HP USB Mouse
    Antivirus
    Windows Defender
  • Operating System
    Windows 11 Pro For Workstations 25H2
    Computer type
    Laptop
    Manufacturer/Model
    HP Zbook G4
    CPU
    Xeon 1535m v6
    Motherboard
    HP
    Memory
    32 GB
    Graphics card(s)
    AMD Quadro Pro 4100
    Sound Card
    Bang and Olufson Audio
    Hard Drives
    1TB SSD
    Mouse
    HP USB Mouse
    Antivirus
    Windows Defender
I'm assuming The AdminDerek13500 is the built in account
Administrator.AdminDerek13500 is not an account. It's a profile created by an account fault - possibly either at a failed login or during a crash whilst logged in to Administrator.

I'm puzzled. I'm convinced I have seen you post the results of the
Net user
command which lists all accounts but I cannot see it now. Perhaps it was just my imagination.
Do post the results of this command to inform replies and ensure misleading suggestions are not made.

I know you've posted the results of Net user Administrator but I thought that the overall Net user results had already been shown.
OK, I've got it now. Your original screenshots told us what net user would tell us.



All the best,
Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 25H2 Build 26200.8037
Interesting.
So there was not [as I had wondered about] a failed attempt to rename the Built-in Admin, just an incident in which it failed to logon successfully.


Have you ever had a failure to log in to the Built-in Admin?
Have you ever tried to do anything unusual with that account such as, but I'm only speculating:
- linking it to an MSAccount - an attempt which it is supposed to reject?
- renaming it?
- applying a password to it?

Is there anything unusual in its properties - look in the response to the cmd
net user Administrator
Here are the properties of mine as an example. Its Full name field is empty, as it should be.
View attachment 149800



Denis
Here's the admin cmd and user list, plus properties of the accounts in question. The AdminDerek13500 is listed in the registry as xxxx 500, which is the code for the MS admin account. So now It's the Administrator account that doesn't appear, as far as I can tell. Could it be leftover from windows 10, before updating to 11? I had my antivirus institute a password change on 2 accounts, one of them was either one of the Admin accounts but i'm not sure which one was done, Admin or adminDerek 13500

Apologies for dragging this out, it seems the more I dig the into this the stranger it gets.

Admin010.webp


Admin007.webpAdmin008.webp
 

My Computer

System One

  • OS
    Window 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI
    CPU
    I5 13500
    Motherboard
    MSI B760 Tomahawk
    Memory
    32 G ddr4
So now It's the Administrator account that doesn't appear
Yes it does.
1761212473048.webp


You cannot mix up accounts with profiles.
Those folders are associated with accounts but they are folders belonging to profiles; they are not accounts.
Your three accounts are shown in the diagram above.

Could it be leftover from windows 10
There's no telling when an incident happened that caused the Administrator.AdminDerek13500 profile [& folder] to appear.

I had my antivirus institute a password change on 2 accounts, one of them was either one of the Admin accounts but i'm not sure which one was done, Admin
You tried to change the password of the Built-in Admin, the account with the username Administrator?
Or are you referring to Derek_AD, dwb-bad?
I have not heard of using an anti-malware utility to change account passwords.

Your Built-in Admin, the account with the username Administrator, is normally disabled. You have enabled yours.
Does it have a password?
I suggest you find out and then disable it again.



All the best,
Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 25H2 Build 26200.8037
Back
Top Bottom