Automatic local user account named "John" created in Windows 8.1

I have a laptop that the other day a user was logged into the computer with a "Microsoft" account.  

On 3.22.2014 she was using her computer as a different user.  A local user named "John"

I remoted into her computer on Monday night and deleted the user account and the user profile folder.  After rebooting her computer "John" was back.  (Had I not seen it with y own eyes I'd not believe it)

I had her bring me the machine and I a have it in my possession now.  I renamed the account to "Fred" and put a password on it and rebooted several time and all is well.  Fred is still there.

I then deleted the Fred account and rebooted and viola John is back.  WTF???

I am about to re-image the machine but I'd like to know how or why this happen.  

Any thoughts?
Who is Participating?
Sikhumbuzo NtsadaConnect With a Mentor Senior IT TechnicianCommented:
I used an imaging tool before that created a standard username on the PC.

Was this a fresh install from DVD or from an image?
MereteConnect With a Mentor Commented:
Not a user of windows 8 yet
which version of windows 8 please
but you should have user profiles( not accounts)
> what Profiles are listed in the system properties advanced settings User Profiles>settings? Desktop settings related to your logon.
Logon as the local administrator.
system propertiesWorking with the Local Users and Groups Snap-In windows 8
In Windows RT, 8, and 8.1, the Local Users and Groups will only be available in the Pro and Enterpise editions.
Because of this here is more options to alter the regestry in windows 8 if it is not part of those versions
Make a User default
Easy How to Windows 7 and 8 Default Profile
Hope it helps
JohnConnect With a Mentor Business Consultant (Owner)Commented:
Go to the Settings icon on the right side. Make it appear by moving your mouse to the right side.

Then select Change PC Settings (lower right). Then select Accounts.

Make sure the Account type is set to Microsoft Account or Local (your choice - I use local). Then the account should be the type you set when you reboot.

If not, then try a Windows 8 Refresh (Action Center, Recovery) before rebuilding. Ultimately, however, you may need to rebuild if something has gone wrong with the operating system.
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

JohnConnect With a Mentor Business Consultant (Owner)Commented:
It also occurs to me that your user may be just as well off with a local account. That is why I use, although I do understand this is personal preference.

So if you go to PC Settings and select local account and if that sticks over reboot, then that may be a workable solution for you.
Daeta42Author Commented:
Sikhumbuzo Ntsada - This was a fresh install from the factory that she has had for about 6 months.  When we setup her machine there was no local user account.  She only used the Microsoft account.  

The odd thing is that we can pinpoint the day that "John" appeared was on 3.22.14.  Even better it was at 1:44PM PST.

It seems that this is a mystery that will never be solved.  We ended up re-imaging the machine because we couldn't get it to stop bringing "John" back into her life.
JohnBusiness Consultant (Owner)Commented:
@Daeta42 - Thanks for the update and I was happy to help.
Wonder who was John was ;)
Sikhumbuzo NtsadaSenior IT TechnicianCommented:
Hi Daeta42

In the unfortunate event of John coming for a visit again, could you please create a Virtual Instance of the machine before formatting it so that we can spend more time troubleshooting.

I am very curious to find out what really happened.
Daeta42Author Commented:
Sure thing.  I will monitor the machine.
Daeta42Author Commented:

We figured out what happen!!!  I had another customer come in today with a similar issue.  But, this guy actually knew a wee bit more about his technology.  

We found out that both of these customers have ESET Smart Security Suite.  Which has "Anti-Theft" built in.  

The Anti-Theft feature creates a local account that ESET uses if your laptop is stolen.

It is the Anti-theft feature, it create a "fake account" destined to lure the thief into it, this account has no password, and once in it , he will think he can use your laptop safely, in fact the location is transmitted to your web interface in ESET website where you can stealthily take pictures of the thief via the webcam; then the screenshot is transmitted to your web interface.

Thanks again all!


omg that is unreal.
Is that written in the Eset PDF guides?
That's amazing really.
Thank you very much for posting that solution should impress anyone else who has experienced that.
Bet Eset Anti-Theft feature is MOIHAHAHAHA -ing!!
Sikhumbuzo NtsadaSenior IT TechnicianCommented:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.