• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3226
  • Last Modified:

Automatic local user account named "John" created in Windows 8.1

I have a laptop that the other day a user was logged into the computer with a "Microsoft" account.  


On 3.22.2014 she was using her computer as a different user.  A local user named "John"

I remoted into her computer on Monday night and deleted the user account and the user profile folder.  After rebooting her computer "John" was back.  (Had I not seen it with y own eyes I'd not believe it)

I had her bring me the machine and I a have it in my possession now.  I renamed the account to "Fred" and put a password on it and rebooted several time and all is well.  Fred is still there.

I then deleted the Fred account and rebooted and viola John is back.  WTF???

I am about to re-image the machine but I'd like to know how or why this happen.  

Any thoughts?
0
Daeta42
Asked:
Daeta42
  • 3
  • 3
  • 3
  • +1
4 Solutions
 
Sikhumbuzo NtsadaSenior IT TechnicianCommented:
I used an imaging tool before that created a standard username on the PC.

Was this a fresh install from DVD or from an image?
0
 
MereteCommented:
Hi
Not a user of windows 8 yet
which version of windows 8 please
but you should have user profiles( not accounts)
> what Profiles are listed in the system properties advanced settings User Profiles>settings? Desktop settings related to your logon.
Logon as the local administrator.
system propertiesWorking with the Local Users and Groups Snap-In windows 8
In Windows RT, 8, and 8.1, the Local Users and Groups will only be available in the Pro and Enterpise editions.
Because of this here is more options to alter the regestry in windows 8 if it is not part of those versions
http://www.sevenforums.com/tutorials/120499-local-users-groups-mmc-snap-enable-disable.html
Make a User default
Easy How to Windows 7 and 8 Default Profile
http://dibbsolutions.com/support-training/windows-7-default-profile/
Hope it helps
Merete
0
 
John HurstBusiness Consultant (Owner)Commented:
Go to the Settings icon on the right side. Make it appear by moving your mouse to the right side.

Then select Change PC Settings (lower right). Then select Accounts.

Make sure the Account type is set to Microsoft Account or Local (your choice - I use local). Then the account should be the type you set when you reboot.

If not, then try a Windows 8 Refresh (Action Center, Recovery) before rebuilding. Ultimately, however, you may need to rebuild if something has gone wrong with the operating system.
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
John HurstBusiness Consultant (Owner)Commented:
It also occurs to me that your user may be just as well off with a local account. That is why I use, although I do understand this is personal preference.

So if you go to PC Settings and select local account and if that sticks over reboot, then that may be a workable solution for you.
0
 
Daeta42Author Commented:
Sikhumbuzo Ntsada - This was a fresh install from the factory that she has had for about 6 months.  When we setup her machine there was no local user account.  She only used the Microsoft account.  

The odd thing is that we can pinpoint the day that "John" appeared was on 3.22.14.  Even better it was at 1:44PM PST.

It seems that this is a mystery that will never be solved.  We ended up re-imaging the machine because we couldn't get it to stop bringing "John" back into her life.
0
 
John HurstBusiness Consultant (Owner)Commented:
@Daeta42 - Thanks for the update and I was happy to help.
0
 
MereteCommented:
Thankyou..Daeta42
Wonder who was John was ;)
0
 
Sikhumbuzo NtsadaSenior IT TechnicianCommented:
Hi Daeta42

In the unfortunate event of John coming for a visit again, could you please create a Virtual Instance of the machine before formatting it so that we can spend more time troubleshooting.

I am very curious to find out what really happened.
0
 
Daeta42Author Commented:
Sure thing.  I will monitor the machine.
0
 
Daeta42Author Commented:
AAAAHAHAHAHAHAA!!!!!

We figured out what happen!!!  I had another customer come in today with a similar issue.  But, this guy actually knew a wee bit more about his technology.  

We found out that both of these customers have ESET Smart Security Suite.  Which has "Anti-Theft" built in.  

The Anti-Theft feature creates a local account that ESET uses if your laptop is stolen.

It is the Anti-theft feature, it create a "fake account" destined to lure the thief into it, this account has no password, and once in it , he will think he can use your laptop safely, in fact the location is transmitted to your web interface in ESET website where you can stealthily take pictures of the thief via the webcam; then the screenshot is transmitted to your web interface.

Thanks again all!

Cheers!

~~Daeta
1
 
MereteCommented:
omg that is unreal.
Is that written in the Eset PDF guides?
That's amazing really.
Thank you very much for posting that solution should impress anyone else who has experienced that.
Excellent
Bet Eset Anti-Theft feature is MOIHAHAHAHA -ing!!
0
 
Sikhumbuzo NtsadaSenior IT TechnicianCommented:
Wow.
0

Featured Post

Cyber Threats to Small Businesses (Part 2)

The evolving cybersecurity landscape presents SMBs with a host of new threats to their clients, their data, and their bottom line. In part 2 of this blog series, learn three quick processes Webroot’s CISO, Gary Hayslip, recommends to help small businesses beat modern threats.

  • 3
  • 3
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now