Solved

Automatic local user account named "John" created in Windows 8.1

Posted on 2014-03-26
12
2,514 Views
Last Modified: 2014-04-05
I have a laptop that the other day a user was logged into the computer with a "Microsoft" account.  


On 3.22.2014 she was using her computer as a different user.  A local user named "John"

I remoted into her computer on Monday night and deleted the user account and the user profile folder.  After rebooting her computer "John" was back.  (Had I not seen it with y own eyes I'd not believe it)

I had her bring me the machine and I a have it in my possession now.  I renamed the account to "Fred" and put a password on it and rebooted several time and all is well.  Fred is still there.

I then deleted the Fred account and rebooted and viola John is back.  WTF???

I am about to re-image the machine but I'd like to know how or why this happen.  

Any thoughts?
0
Comment
Question by:Daeta42
  • 3
  • 3
  • 3
  • +1
12 Comments
 
LVL 17

Accepted Solution

by:
Sikhumbuzo Ntsada earned 125 total points
Comment Utility
I used an imaging tool before that created a standard username on the PC.

Was this a fresh install from DVD or from an image?
0
 
LVL 69

Assisted Solution

by:Merete
Merete earned 125 total points
Comment Utility
Hi
Not a user of windows 8 yet
which version of windows 8 please
but you should have user profiles( not accounts)
> what Profiles are listed in the system properties advanced settings User Profiles>settings? Desktop settings related to your logon.
Logon as the local administrator.
system propertiesWorking with the Local Users and Groups Snap-In windows 8
In Windows RT, 8, and 8.1, the Local Users and Groups will only be available in the Pro and Enterpise editions.
Because of this here is more options to alter the regestry in windows 8 if it is not part of those versions
http://www.sevenforums.com/tutorials/120499-local-users-groups-mmc-snap-enable-disable.html
Make a User default
Easy How to Windows 7 and 8 Default Profile
http://dibbsolutions.com/support-training/windows-7-default-profile/
Hope it helps
Merete
0
 
LVL 90

Assisted Solution

by:John Hurst
John Hurst earned 250 total points
Comment Utility
Go to the Settings icon on the right side. Make it appear by moving your mouse to the right side.

Then select Change PC Settings (lower right). Then select Accounts.

Make sure the Account type is set to Microsoft Account or Local (your choice - I use local). Then the account should be the type you set when you reboot.

If not, then try a Windows 8 Refresh (Action Center, Recovery) before rebuilding. Ultimately, however, you may need to rebuild if something has gone wrong with the operating system.
0
 
LVL 90

Assisted Solution

by:John Hurst
John Hurst earned 250 total points
Comment Utility
It also occurs to me that your user may be just as well off with a local account. That is why I use, although I do understand this is personal preference.

So if you go to PC Settings and select local account and if that sticks over reboot, then that may be a workable solution for you.
0
 

Author Closing Comment

by:Daeta42
Comment Utility
Sikhumbuzo Ntsada - This was a fresh install from the factory that she has had for about 6 months.  When we setup her machine there was no local user account.  She only used the Microsoft account.  

The odd thing is that we can pinpoint the day that "John" appeared was on 3.22.14.  Even better it was at 1:44PM PST.

It seems that this is a mystery that will never be solved.  We ended up re-imaging the machine because we couldn't get it to stop bringing "John" back into her life.
0
 
LVL 90

Expert Comment

by:John Hurst
Comment Utility
@Daeta42 - Thanks for the update and I was happy to help.
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 69

Expert Comment

by:Merete
Comment Utility
Thankyou..Daeta42
Wonder who was John was ;)
0
 
LVL 17

Expert Comment

by:Sikhumbuzo Ntsada
Comment Utility
Hi Daeta42

In the unfortunate event of John coming for a visit again, could you please create a Virtual Instance of the machine before formatting it so that we can spend more time troubleshooting.

I am very curious to find out what really happened.
0
 

Author Comment

by:Daeta42
Comment Utility
Sure thing.  I will monitor the machine.
0
 

Author Comment

by:Daeta42
Comment Utility
AAAAHAHAHAHAHAA!!!!!

We figured out what happen!!!  I had another customer come in today with a similar issue.  But, this guy actually knew a wee bit more about his technology.  

We found out that both of these customers have ESET Smart Security Suite.  Which has "Anti-Theft" built in.  

The Anti-Theft feature creates a local account that ESET uses if your laptop is stolen.

It is the Anti-theft feature, it create a "fake account" destined to lure the thief into it, this account has no password, and once in it , he will think he can use your laptop safely, in fact the location is transmitted to your web interface in ESET website where you can stealthily take pictures of the thief via the webcam; then the screenshot is transmitted to your web interface.

Thanks again all!

Cheers!

~~Daeta
0
 
LVL 69

Expert Comment

by:Merete
Comment Utility
omg that is unreal.
Is that written in the Eset PDF guides?
That's amazing really.
Thank you very much for posting that solution should impress anyone else who has experienced that.
Excellent
Bet Eset Anti-Theft feature is MOIHAHAHAHA -ing!!
0
 
LVL 17

Expert Comment

by:Sikhumbuzo Ntsada
Comment Utility
Wow.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Some of the most commonly posted questions in the "Virus & Malware" Zones are related to the family of rogue malware with the date "2012" somewhere in the title. Examples: XP Antispyware 2012 XP Antivirus 2012 XP Security 2012   XP Home Sec…
It started not too long ago. It was at first annoying. My keystrokes seemed to be randomly generated, not the ones I typed on the keyboard. For some reason this only happened in certain applications (especially browsers such as IE11, Firefox and Chr…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now