Solved Unknown Account under all Registry Keys after Clean Install


farvatten

Well-known member
Local time
2:19 PM
Posts
24
OS
Windows 11 Pro 64bit 25H2 26200.9445
Anyone else seeing Account Unknown:

S-1-15-3-1024-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN

under ALL their Registry Key Permissions with Read Only?

It's appearing early at the very beginning of the OOBE screens, both platforms, and is persistent.



UnknownAccountWin11OOBE.jpg
 

My Computers My Computers

  • At a glance

    Windows 11 Pro 64bit 25H2 26200.9445Intel Core i5-3450 CPU@ 3.10GHz8.00 GBNvidia GeForce GT 640
    OS
    Windows 11 Pro 64bit 25H2 26200.9445
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • At a glance

    Windows 11 Home 64bit 25H2 26200.9445Intel Core i5-6200U CPU@ 2.40GHz8.00GBIntel(R) HD Graphics 520
    Operating System
    Windows 11 Home 64bit 25H2 26200.9445
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
Sometimes installed software can create a user account like third-party antivirus software.
 

My Computer My Computer

At a glance

Windows 11AMD Ryzen 7 5700GMicron Technology DDR4-3200 16GBNVIDIA GeForce RTX 3060
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
HP Pavilion
CPU
AMD Ryzen 7 5700G
Motherboard
Erica6
Memory
Micron Technology DDR4-3200 16GB
Graphics Card(s)
NVIDIA GeForce RTX 3060
Sound Card
Realtek ALC671
Monitor(s) Displays
Samsung SyncMaster U28E590
Screen Resolution
3840 x 2160
Hard Drives
SAMSUNG MZVLQ1T0HALB-000H1
Sometimes installed software can create a user account like third-party antivirus software.

That's why it's so odd, this happened at the very begnining of OOBE even before account set up and after a clean install from a MCT USB on a TPM 2 machine with Secure Boot, so the Windows 11 installer created it very early on then removed the account leaving behind this on each and every Registry entry. Seems sloppy.
 

My Computers My Computers

  • At a glance

    Windows 11 Pro 64bit 25H2 26200.9445Intel Core i5-3450 CPU@ 3.10GHz8.00 GBNvidia GeForce GT 640
    OS
    Windows 11 Pro 64bit 25H2 26200.9445
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • At a glance

    Windows 11 Home 64bit 25H2 26200.9445Intel Core i5-6200U CPU@ 2.40GHz8.00GBIntel(R) HD Graphics 520
    Operating System
    Windows 11 Home 64bit 25H2 26200.9445
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
Hit the Windows Key + R button combination on your keyboard. Type in lusrmgr. msc and hit Enter. It will open the Local Users and Groups window. See if you can delete the account.
 

My Computer My Computer

At a glance

Windows 11AMD Ryzen 7 5700GMicron Technology DDR4-3200 16GBNVIDIA GeForce RTX 3060
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
HP Pavilion
CPU
AMD Ryzen 7 5700G
Motherboard
Erica6
Memory
Micron Technology DDR4-3200 16GB
Graphics Card(s)
NVIDIA GeForce RTX 3060
Sound Card
Realtek ALC671
Monitor(s) Displays
Samsung SyncMaster U28E590
Screen Resolution
3840 x 2160
Hard Drives
SAMSUNG MZVLQ1T0HALB-000H1
T
Hit the Windows Key + R button combination on your keyboard. Type in lusrmgr. msc and hit Enter. It will open the Local Users and Groups window. See if you can delete the account.
The account was apparently created then deleted during set up that's why it's showing up as Unknown Account.

So there's nothing in lusrmgr.msc or under:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
 

My Computers My Computers

  • At a glance

    Windows 11 Pro 64bit 25H2 26200.9445Intel Core i5-3450 CPU@ 3.10GHz8.00 GBNvidia GeForce GT 640
    OS
    Windows 11 Pro 64bit 25H2 26200.9445
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • At a glance

    Windows 11 Home 64bit 25H2 26200.9445Intel Core i5-6200U CPU@ 2.40GHz8.00GBIntel(R) HD Graphics 520
    Operating System
    Windows 11 Home 64bit 25H2 26200.9445
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
its just the telemetry admin account. no need to worry about it. nothing shady going on here :)
 

My Computer My Computer

At a glance

Windows 11 Pro
OS
Windows 11 Pro
its just the telemetry admin account. no need to worry about it. nothing shady going on here :)
Thanks for the info! I don't remember seeing this under Windows 10?
 
Last edited:

My Computers My Computers

  • At a glance

    Windows 11 Pro 64bit 25H2 26200.9445Intel Core i5-3450 CPU@ 3.10GHz8.00 GBNvidia GeForce GT 640
    OS
    Windows 11 Pro 64bit 25H2 26200.9445
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • At a glance

    Windows 11 Home 64bit 25H2 26200.9445Intel Core i5-6200U CPU@ 2.40GHz8.00GBIntel(R) HD Graphics 520
    Operating System
    Windows 11 Home 64bit 25H2 26200.9445
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
Thanks for the info! I don't remember seeing this under Windows 10?
oh my response was 100% facetious... sorry. cant express tone over typing...
 

My Computer My Computer

At a glance

Windows 11 Pro
OS
Windows 11 Pro
I guess I don't look at Registry Permissions very often as this issue goes back 4 years.

So after loading up my Registry Hives from Macrium backups going back to Version 1609, this issue first appeared with the 1703 feature update and is associated with poorly programed Appx Containers.

Registry permissions after 1703 update - Unknown Account

All these "strange" SID starting by "{S-1-15-3-1024-" are in fact pseudo accounts created for AppX containers (each AppX has its own SID).
 

My Computers My Computers

  • At a glance

    Windows 11 Pro 64bit 25H2 26200.9445Intel Core i5-3450 CPU@ 3.10GHz8.00 GBNvidia GeForce GT 640
    OS
    Windows 11 Pro 64bit 25H2 26200.9445
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • At a glance

    Windows 11 Home 64bit 25H2 26200.9445Intel Core i5-6200U CPU@ 2.40GHz8.00GBIntel(R) HD Graphics 520
    Operating System
    Windows 11 Home 64bit 25H2 26200.9445
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
Back
Top Bottom