is Account Unknown(S-1-5-21-235848236-322578882-4173758772-1003) Trace of Hack or Malware or part of Windows?

Hello Sugram,

Thank you for posting your query in Microsoft Community.

Account Unknown can come from a previous installation or from an account that previously existed but has since been deleted. This user account does not belong to any Account Groups.

Please help me with the following information:

1. Which Operating system do you have on your computer?

2. Have you update to new Windows Operating system from any previous Operating system?

i have Windows 8.1, first time when i got the PC, when i logged on firs time i got confused & made Microsoft account & logged on with that, & when i noticed that it wont automatically log on like local acc dose i made Local acc (i like easy access to my Home PC, i mean with out password), when i did it my user folder in C:\Users, my folder user name did not change, it was same as it was with Microsoft acc, only desktop user folder changed name, is that account unknown part of the Microsoft acc what i used to log on first time?  

Account Unknown only exists on the list whats on the picture above, in security settings, it dose not show nowhere else in my PC, so if it exist only in the security settings picture above, then i can't add it to any group

my PC is not old, got it a month ago, maybe bit less then month maybe bit more then month

Hi Sugram,

Thank you for replying with the status of the issue, sorry for delay in response.

Are you trying to add the Account Unknown to any group on your computer or, are you looking a way to remove that account from the account properties list?

If you are trying to remove the Account Unknown from the computer highlight (select) the account as seen in the screen shot you sent in the initial response click on Edit and then you would be able to remove the account unknown.

If you still unable to remove the account unknown, please refer to the suggestion from 'Mike P replied on April 1, 2013
http://answers.microsoft.com/en-us/windows/forum/windows_8-security/how-do-i-remove-the-unknown-account-s-1-15-3-4096/a2a7d816-ba01-4122-a383-f4a1732b3dc5

Hope this helps, please reply with the required information and the status of the issue for further assistance.

i never tried to remove account unknown cause some sources say it may cause problems with windows, but not sure are they right or not

my question is, is it something bad or just fragment of when i logged on in my PC first time & i did it with Microsoft acc, i mentioned it before, my interest was just to find out is it harmless, just a fragment of Microsoft acc what i used to log on to my PC

Hi Sugram,

Thank you for replying with the status of the issue, I am sorry for delay in response.

There is no harm for your computer if the Account unknown is showing or removed from the accounts properties list as it is just a replica of the Microsoft account that you initially created to login to the computer, which is no longer in use.

I suggest you to leave the Account Unknown(S-1-5-21-235848236-322578882-4173758772-1003 in the Accounts properties > Security Tab list as it will not effect your computer or its performance. 

If you still concerned about the Account Unknown, take a backup of that account unknown and remove it from the computer please refer to my previous suggestion.

Hope this information helps, please reply if you need further assistance.

Hello,

I know this is a old thread, but please respond.

I got the same account (S-1-5-21-4254420037-26365961197-2239898570-1000) I downloaded a program and checked for ANYTHING! I scanned with malwarebytes, avast and virustotal.com. No viruses. Then i right clicked the program and clicked feature. Then i saw this unknown account. I can see that the unknown account got the same access as my account. 

Hello,

We're here to help. Let us isolate your concern by answering the following questions:

• Have you made any changes prior to this?
• What version of Windows are you using?

If you are not using the Unknown account, you can just simply remove it. Follow the steps below:

1. Go to Control Panel.
2. Search for User Accounts.
3. Click on Manage another account.
4. Click on the unknown account that you are referring to.
5. Click the Delete the account option.
6. Choose whether to delete or keep the files.

Let us know how it goes.

Hi. I just found this thread and I am having the same issue along with some other issues that all started Thursday Sept 8. I have two of them: Account Unknown(S-1-5-21-1815995351-3488429410-2291634709-1005) and Account Unknown(S-1-5-21-1815995351-3488429410-2291634709-1007)

I just tried your suggestion:

1. Go to Control Panel.
2. Search for User Accounts.
3. Click on Manage another account.

Neither of the Account Unknown,,, is listed there, they are only listed in security tab of any object or document I have. I have only ever installed myself (as administrator) and guest account has never been, and is not now enabled. Other problems that started Thursday: I opened Chrome and typed quizlet.com?login (teaching resource) in the address bar. During the typing, before I hit enter, Chrome was hi-jacked. I am still trying to find malware that may have been installed. I was running McAfee LiveSafe which came on the HP laptop I have. McAfee has proven to be worthless with this. It was somehow corrupted in this trainwreck and could not be repaired either manually or automatically by MVT.exe. I uninstalled McAfee. Windows Defender and Firewall is updated and now protecting my system. I have tried AMWB, Adwcleaner, MBAM. None of them fing a problem, but something is not right. 

My question is, Is the Unknown Account related to this? I have googled extensively these problems and found several answers. None of them have worked. I need help. 

Just a side note. The only thing that changed in the last month on my PC:

1.)  I let windows update install new driver Realtek Semiconductor Corp. WLAN software update released in August, 2016

2.) I installed Samsung USB driver for mobile phone and KIES, both from samsung.com (signed by samsung)

Any suggestion, any tools that I haven't already ran, any other thread or forum to read, anything at all would be extremely helpful. I am almost out of hair to pull out of my head. 

Hi,

To answer your question, no, the unknown user account is not related to what happened in Google Chrome. Unknown user accounts will show up if your files or folders are also being shared to other networks or devices.

You can check if the folder is shared by going to the Properties option of the folder and clicking on the Sharing tab.  Once you click on Advanced Sharing it would tell you if its enabled or not.

To remove the unknown users under Security, follow the steps below:

1.  Select and right click on the folder you wish to remove the unknown users.
2.  Click Properties, and go to the Security tab.
3.  Click the Edit button.
4.  Select the username you want to remove, and click Remove.
5.  Click Apply, and then OK.

Let us know how it goes.

"You can't remove S-1-5-21 2257592856-914930904-220741112-1001 because this object is inheriting from it's parent. To remove this, you must prevent this object from inheriting permission.  After disabling

the inheritance and removing this "ghost" account, files that have this account as owner, these files won't open and rebooting the system this account shows up like before on the files, and partition.

In my case , I freshly re-installed win 10 pro, legal version and even several times, deleted and re-installed on  C:\ drive  and not saving previous setting on the boot drive, however on  the second hard drive my old files, still have this old ghost encrypt lock.

Any suggestion to shake off this ghost from files, folders from users ? Any chance  for these documents?

Thanks