Account Unknown(S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176)

I have a situation where it appears that Microsoft is using these SID Accounts to delete my files. On the 17th September 2024, several files were deleted from my PC. This is not the first time and I contacted Microsoft Support who claim that the files were not deleted by Microsoft but cannot show me why or how the files were deleted. I created five .cpr Cubase projects using midi files that allow me to be able to select tones on the Yamaha Integra - and they were deleted from my machine. I had also mixed down an EWF song (Audio file) from one of three midi files and this was also deleted at that same time. For months on end, Microsoft or someone is deleting files when I am building LLM applications, 3D applications and now simple music projects - On right clicking on the Cubase 12 Pro .exe file - I noticed that this Unknown SID account had also given itself Special Permission to delete my files! Who appointed Microsoft to patrol and delete personal files. The files still appear in my recently accessed files and are also listed on my recently accessed files in Cubase 12 Pro. However, there are nowhere to be found on my machine or on One Drive. I am demanding an explanation as to what gives Microsoft the right (or if not Microsoft any other big corporation) to delete files from my machine or any other personal machine or even to set up access accounts to my machine for patrolling and deleting my personal files.

i wasn't sure which post to repy to in this thread, so i just went with the first one. i encountered one of these account unknown sid entries after doing a factory reinstall on my laptop following a primary (ssd) drive replacement. the factory restore installed win10 home 1803. from there i updated (using windows update) to win10 pro 22h2. then i upgraded to win11 232h2 (again using windows update). because the factory installed ssd was really tiny (256gb), i relied on an external wd black drive (P10 game drive) to store much of the files i downloaded to my system. along with my games. longt story short, when i went to access my fies on the drive, i was initially denied access the drive permissions were looking for my previous install, which died with my previous ssd. so i went to refresh the permissions and there was one of those account unknown ssid permissions listed on the drive where i had redirected the stuff from my user profile. i looked at the permissions for c:\users%user_name_here% and it ALSO had one of those entries. so i started doing research. this post was of course one of the things i stumbled across, but i also found a more informative link posted here:

https://www.windowsdigitals.com/windows-11-account-unknown-s-1-15-3-or-s-1-5-21/#What_are_Account_Unknown_S-1-15-3_and_S-1-5-21_in_Windows_11

in my case, like the OP, i was seeing as SID 'S-1-15-3' entry. this document really helped me decide on how to proceed. i ended up leaving the entry alone on my C:\users%user_name_here% directory, but removed it from the E:\users%user_name_here% directory. i figure if windows really does need it, it can add it back without any issues since its a non-system directory.

i am not sure what part of windows compatibility got removed from windows 11 (as per the linked page) but it seems safe to at least remove it from the permissions on my external drive. imho, i would not remove it from any directory on the C:\ drive. for all i know, it might be used for windows defender's 'controlled folder access' feature (ransomware protection). i don't have it turned on atm, because i am still making changes and reinstalling lots of stuff, but i will turn it on once i am finished getting my system in order.

Windows 11 Pro

MSI GE-73 Raider RGB 8RE Upgrades: 32 Gb DDR3200, Intel Optane M10 32gb, WD_Black SN850X 4Gb

Account Unknown(S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176) has now seemingly disabled access to Windows Security on my OS Windows 11 Professional (x64) Version 23H2 (build 22631.3880).

Trying to open Windows Security gives blank pages, except for "Virus & threat protection" page which now says "Page not available. Your IT administrator has limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information"

How can user reinstate full access to all pages within Windows Security?

hey imran i have same problem what can i do please tell me

Here's some additional info on this subject.

Some SIDs do not resolve into friendly names | Microsoft Learn
https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/sids-not-resolve-into-friendly-names