Account Unknown(S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176)

i wasn't sure which post to repy to in this thread, so i just went with the first one. i encountered one of these account unknown sid entries after doing a factory reinstall on my laptop following a primary (ssd) drive replacement. the factory restore installed win10 home 1803. from there i updated (using windows update) to win10 pro 22h2. then i upgraded to win11 232h2 (again using windows update). because the factory installed ssd was really tiny (256gb), i relied on an external wd black drive (P10 game drive) to store much of the files i downloaded to my system. along with my games. longt story short, when i went to access my fies on the drive, i was initially denied access the drive permissions were looking for my previous install, which died with my previous ssd. so i went to refresh the permissions and there was one of those account unknown ssid permissions listed on the drive where i had redirected the stuff from my user profile. i looked at the permissions for c:\users%user_name_here% and it ALSO had one of those entries. so i started doing research. this post was of course one of the things i stumbled across, but i also found a more informative link posted here:

https://www.windowsdigitals.com/windows-11-account-unknown-s-1-15-3-or-s-1-5-21/#What_are_Account_Unknown_S-1-15-3_and_S-1-5-21_in_Windows_11

in my case, like the OP, i was seeing as SID 'S-1-15-3' entry. this document really helped me decide on how to proceed. i ended up leaving the entry alone on my C:\users%user_name_here% directory, but removed it from the E:\users%user_name_here% directory. i figure if windows really does need it, it can add it back without any issues since its a non-system directory.

i am not sure what part of windows compatibility got removed from windows 11 (as per the linked page) but it seems safe to at least remove it from the permissions on my external drive. imho, i would not remove it from any directory on the C:\ drive. for all i know, it might be used for windows defender's 'controlled folder access' feature (ransomware protection). i don't have it turned on atm, because i am still making changes and reinstalling lots of stuff, but i will turn it on once i am finished getting my system in order.

Windows 11 Pro

MSI GE-73 Raider RGB 8RE Upgrades: 32 Gb DDR3200, Intel Optane M10 32gb, WD_Black SN850X 4Gb

I have a situation where it appears that Microsoft is using these SID Accounts to delete my files. On the 17th September 2024, several files were deleted from my PC. This is not the first time and I contacted Microsoft Support who claim that the files were not deleted by Microsoft but cannot show me why or how the files were deleted. I created five .cpr Cubase projects using midi files that allow me to be able to select tones on the Yamaha Integra - and they were deleted from my machine. I had also mixed down an EWF song (Audio file) from one of three midi files and this was also deleted at that same time. For months on end, Microsoft or someone is deleting files when I am building LLM applications, 3D applications and now simple music projects - On right clicking on the Cubase 12 Pro .exe file - I noticed that this Unknown SID account had also given itself Special Permission to delete my files! Who appointed Microsoft to patrol and delete personal files. The files still appear in my recently accessed files and are also listed on my recently accessed files in Cubase 12 Pro. However, there are nowhere to be found on my machine or on One Drive. I am demanding an explanation as to what gives Microsoft the right (or if not Microsoft any other big corporation) to delete files from my machine or any other personal machine or even to set up access accounts to my machine for patrolling and deleting my personal files.

I've noticed that a lot of posts in this thread appear to have the following general substance:

Hi, I'm a computer user with NO formal education in InfoSec, but I DEFINITELY know what I am talking about! I have read SEVERAL blogs and forum posts about Windows security, which qualifies me as a SECURITY EXPERT. These "unknown" SIDs are UNQUESTIONABLY either a 1337 h4x0r breaking into my computer, or M$ spying on me; there's NO POSSIBLE WAY they could be legitimate components of an incredibly complex operating system that are necessary for the OS to function properly. I'm so certain of this that I did not need to do ANY research on this specific SID to see if it could be, for example, a known Capability SID.

So I just removed it from the ACL, completely ignoring any warning messages that may have come up in the process. (Who reads those warnings anyway? They are just LIES from M$ to cover up their BLATANT spying activities!)

But ever since then, a certain component of Windows hasn't been working right. This is PROOF that M$ has crippled my PC in retaliation for me putting a stop to their OBVIOUS spyware. It's definitely NOT an indication that I broke something by removing that SID from the ACL. I'm an EXPERT, remember?

smh

This post is not directed at anyone in particular. If you are offended by the content of this post, consider the possibility that the reason you take offense is that you realize that it describes you, and consider what that actually means.

I am not offended at all. My post is specifically about files being deleted from my machine. So you continue your fight ... I will continue mine.