Solved Unknown Account under all Registry Keys after Clean Install


farvatten

Well-known member
Local time
8:11 AM
Posts
14
OS
Windows 10 Pro 64bit 22H2 19045.2965
Anyone else seeing Account Unknown:

S-1-15-3-1024-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN

under ALL their Registry Key Permissions with Read Only?

It's appearing early at the very beginning of the OOBE screens, both platforms, and is persistent.



UnknownAccountWin11OOBE.jpg
 

My Computers

System One System Two

  • OS
    Windows 10 Pro 64bit 22H2 19045.2965
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • Operating System
    Windows 11 Home 64bit 22H2 22621.1702
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
Sometimes installed software can create a user account like third-party antivirus software.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP Pavilion
    CPU
    AMD Ryzen 7 5700G
    Motherboard
    Erica6
    Memory
    Micron Technology DDR4-3200 16GB
    Graphics Card(s)
    NVIDIA GeForce RTX 3060
    Sound Card
    Realtek ALC671
    Monitor(s) Displays
    Samsung SyncMaster U28E590
    Screen Resolution
    3840 x 2160
    Hard Drives
    SAMSUNG MZVLQ1T0HALB-000H1
Sometimes installed software can create a user account like third-party antivirus software.

That's why it's so odd, this happened at the very begnining of OOBE even before account set up and after a clean install from a MCT USB on a TPM 2 machine with Secure Boot, so the Windows 11 installer created it very early on then removed the account leaving behind this on each and every Registry entry. Seems sloppy.
 

My Computers

System One System Two

  • OS
    Windows 10 Pro 64bit 22H2 19045.2965
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • Operating System
    Windows 11 Home 64bit 22H2 22621.1702
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
Hit the Windows Key + R button combination on your keyboard. Type in lusrmgr. msc and hit Enter. It will open the Local Users and Groups window. See if you can delete the account.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP Pavilion
    CPU
    AMD Ryzen 7 5700G
    Motherboard
    Erica6
    Memory
    Micron Technology DDR4-3200 16GB
    Graphics Card(s)
    NVIDIA GeForce RTX 3060
    Sound Card
    Realtek ALC671
    Monitor(s) Displays
    Samsung SyncMaster U28E590
    Screen Resolution
    3840 x 2160
    Hard Drives
    SAMSUNG MZVLQ1T0HALB-000H1
T
Hit the Windows Key + R button combination on your keyboard. Type in lusrmgr. msc and hit Enter. It will open the Local Users and Groups window. See if you can delete the account.
The account was apparently created then deleted during set up that's why it's showing up as Unknown Account.

So there's nothing in lusrmgr.msc or under:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
 

My Computers

System One System Two

  • OS
    Windows 10 Pro 64bit 22H2 19045.2965
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • Operating System
    Windows 11 Home 64bit 22H2 22621.1702
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
its just the telemetry admin account. no need to worry about it. nothing shady going on here :)
 

My Computer

System One

  • OS
    Windows 11 Pro
its just the telemetry admin account. no need to worry about it. nothing shady going on here :)
Thanks for the info! I don't remember seeing this under Windows 10?
 
Last edited:

My Computers

System One System Two

  • OS
    Windows 10 Pro 64bit 22H2 19045.2965
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • Operating System
    Windows 11 Home 64bit 22H2 22621.1702
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520
I guess I don't look at Registry Permissions very often as this issue goes back 4 years.

So after loading up my Registry Hives from Macrium backups going back to Version 1609, this issue first appeared with the 1703 feature update and is associated with poorly programed Appx Containers.

Registry permissions after 1703 update - Unknown Account

All these "strange" SID starting by "{S-1-15-3-1024-" are in fact pseudo accounts created for AppX containers (each AppX has its own SID).
 

My Computers

System One System Two

  • OS
    Windows 10 Pro 64bit 22H2 19045.2965
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8500
    CPU
    Intel Core i5-3450 CPU@ 3.10GHz
    Memory
    8.00 GB
    Graphics Card(s)
    Nvidia GeForce GT 640
  • Operating System
    Windows 11 Home 64bit 22H2 22621.1702
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 5559
    CPU
    Intel Core i5-6200U CPU@ 2.40GHz
    Memory
    8.00GB
    Graphics card(s)
    Intel(R) HD Graphics 520

Latest Support Threads

Back
Top Bottom