Windows 10 creating a new user profile by itself

Copper Contributor

Hello,

I restarted my Windows 10 PC today.  I saw that I had a new user profile to choose from.  The new user is "Daniel" and when I looked at my accounts, it is an Administrator account.

 

I have NOT added any new user with the name "Daniel" or any other name. 

 

I deleted the "Daniel" account.  However, I am concerned about my computer security now.  Should I ask this question elsewhere and if so, where? I will appreciate comments or advice.   Thank you for your attention.

 

- Robert Judge

3 Replies

@RobertGJudge 

Hello, I think someone has access to your computer password - perhaps someone from the family has created a local account for themselves?
Rather remotely, he did not do it, but it is also possible, so it is worth explaining!
The system does not automatically create an account - so a man did it, but did not hide it
so it's not a ruse.

@RobertGJudge 

This could happen if that's the Default User Account (although typically it isn't named "Daniel.") If this was not done intentionally, often this is because file permissions have changed before you restarted. There is a way to change things back, but it is slow (you need WinPE to do this btw. It could take anywhere between 30-40 minutes to several hours.)

REM Batch file to reset ACLs on WinPE for offline images only:
@ECHO OFF
SETLOCAL
icacls C: /remove "ALL RESTRICTED APPLICATION PACKAGES" /c /l /q
icacls C: /remove "ALL APPLICATION PACKAGES" /c /l /q
icacls C: /remove "NT AUTHORITY\Authenticated Users" /c /l /q
icacls C: /remove "NT SERVICE\TrustedInstaller" /c /l /q
icacls C: /inheritance:r /grant:r "NT SERVICE\TrustedInstaller":(OI)(CI)(F) /c /l /q
icacls C: /remove "NT AUTHORITY\SYSTEM" /c /l /q
icacls C: /inheritance:r /grant:r "NT AUTHORITY\SYSTEM":(OI)(CI)(F) /c /l /q
icacls C: /remove "BUILTIN\Users" /c /l /q
icacls C: /inheritance:r /grant:r "BUILTIN\Users":(OI)(CI)(F) /c /l /q
icacls C: /remove "BUILTIN\Administrators" /c /l /q
icacls C: /inheritance:r /grant:r "BUILTIN\Administrators":(OI)(CI)(F) /c /l /q
icacls C: /inheritance:r /grant:r "NT AUTHORITY\Authenticated Users":(OI)(CI)(F) /c /l /q
icacls C: /inheritance:r /grant:r "ALL APPLICATION PACKAGES":(OI)(CI)(F) /c /l /q
icacls C: /remove "Everyone" /c /l /q
icacls "C:\*.*" /reset /t /c /l /q

 

@Mousefluff 

Explain to me why file permissions have changed?
I have never seen such a change in the local account without human intervention.