How to locate unknown user being created in windows 8?

05
2014-04
  • Chesnokov Yuriy

    How to identify unknown user being created in windows 8 machine?

    I found it in System Properties/Advanced/User Profiles/Settings as Account Unknown.

    It is not present in c:\Users nor in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Profile List where only c:\Users accounts are present.

    I found it got attached in one of the c:\ root folders in Security\Group or user names as S-1-5-...something... with only read/list access checked to Deny option

    • Answers
    Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

    Related Question

    Cannot Delete "Account Unknown" account in Windows XP SP3
  • naspinski

    If I Right click on My Computer, Select Properties, then click on Advanced->User Profiles->Settings, I get a list of user accounts on my machine and I see a few that are "Account Unknown" in there with large profiles and I want my space back. I am assuming this is because these users are long gone and AD no longer recognizes their SIDs.

    The problem is that the Delete button is grayed out, but only for the accounts, the ones that are recognized, I can delete jsut fine.

    These accounts do not show up in Computer Management at all, and I am an administrator on my machine - any ideas on how to delete them?


    • Related Answers
  • grawity

    AFAIK, the "User profiles" window only lists user profiles, not accounts -- so you should check C:\Documents and Settings\ for the leftover profile directories.

  • pipTheGeek

    I have encounted this. In my case re-starting the PC then allowed me to delete the orphaned profiles.

    @grawity - you are correct, the list is the list of profiles on this PC, not the list of accounts. However there is information maintained in the registry about which profiles exist on the PC. Mearly deleting the folders from C:\Documents and settings would not remove the profiles from the list.