Unknown accounts appeared at my computer - was my computer compromised?

Perceived problem & environment description:

At few folders in start menu, I noticed there is strange user at security tab. I also see there user in my name, surname and email(microsoft account?). Both users I do not see at lusrmgr. I can see there my admin account which is different from microsoft account. Check that unknown account at picture below.

Unknown account with special permissions - Read&Execute+Read, inherited from StartMenu:

At some other folder, I see two more accounts which I am not sure what they are: CREATOR OWNER and TrustedInstaller. I have tried if it is possible to add rights to these two accounts and it found only CREATOR OWNER. Which I expect is valid but I still would like to know more about it.

I have quite fresh installation of Win10 PRO - few weeks. Firewall on, no special customizations. Also antivir. And not latest version of firmware at router. Sometimes I am visiting high risk places at internet.

Behind router, I have full control of two devices. The other one I don't care about security. My home network is set as private on both computers.

So in summary, the question is:

1. What is this user unknown (S-1-5-21-...) and how it got there? Is there possibility I am compromised based on it's existence?

2. Why my (probably) Microsoft account has special access to the same folder as the unknown account?

3. What is CREATOR OWNER account?

4. What is TrustedInstaller account?

5. Why I do not see any of the four above accounts in lusrmgr?

Thank you for your understanding of my not so high knowledge on this topic.

1 Answer

What is this user unknown (S-1-5-21-...) and how it got there? Is there possibility I am compromised based on it's existence?

It’s the security identifier (SID) of a user that does not exist on your machine. Your computer absolutely has not been compromised.

Why my (probably) Microsoft account has special access to the same folder as the unknown account?

It is absolutely is nothing to worry about. Looking at my own personal machine in greater detail, I have a similar SID, that also has ownership of that particular folder. In reality what you have discovered is a "Compatibility SID" and is a feature of Windows 8+ in order to achieve system functions. You can search for the SID in the registry, if you find it contained within the registry, that means it's a compatibility SID.

If you find the SID in the registry data, then it is a capability SID. By design, it will not resolve into a friendly name. If you do not find the SID in the registry data, then it is not a known capability SID. You can continue to troubleshoot it as a normal unresolved SID. By design, a capability SID does not resolve to a friendly name.

Compatibility SIDs are listed in the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities

Microsoft provides the following warning about compatibility SIDs:

DO NOT DELETE capability SIDS from either the Registry or file system permissions. Removing a capability SID from file system permissions or registry permissions may cause a feature or application to function incorrectly. After you remove a capability SID, you cannot use the UI to add it back.

So the existence of that particular SID is there for a reason. It's not actually a user account, it cannot be used to access your system, and exists in order for Windows 10 to properly function. You should absolutely not remove it's permissions.

Source: Some SIDs do not resolve into friendly names

Your user account, has access to the same folder, because you indicated you had a single unprivileged user account on your system. Since the permissions of all users are based on the user group CREATOR OWNER the permissions are identical. Your Administrator account based on your own description is not linked to a Microsoft Account.

What is CREATOR OWNER account?

CREATOR OWNER is a default user group that exists on every modern Windows machine. It’s used for the purposes of being a template. By default a nonprivileged user has the same permissions to a file as this user group.

What is TrustedInstaller account?

A default system account that exists on every modern Windows machine. Windows uses TrustedInstaller as the owner for system files.

Why I do not see any of the four above accounts in lusrmgr?

User management tools only display accounts that can be logged into, system accounts, only exist to be used by the Windows kernel. The user account linked to the Microsoft account absolutely is listed in the user management tool. You indicated that the is a user, with your name and email address, that is the Microsoft Account. This account is separate from your privileged Administrator account. This means you have 2 accounts that you created.