When you open the properties of a folder or a drive, say the C: drive, you might see some strange groups or user names called “Account Unknown (S-1-15-3-…)” or with other variations like “(S-1-5-21-…)“. It’s normal to feel alarmed when we see these unknown accounts that have control over our files on our computer. This guide will explain what these “Account Unknown” entries are in the properties window.
Also see: How to Take Ownership of a File, Folder or Drive in Windows 11
Page Contents
Why do I see “Account Unknown” on my computer?
You see “Account Unknown” entries when a user account once linked to your files or folders is deleted but the system still has the account’s Security Identifier (SID).
Every user account in Windows has a unique SID. When an account is deleted, Windows can’t recognize the SID anymore, so it shows “Account Unknown” followed by the SID number. This is why you might find these odd entries in your file or drive properties.
Pro tip: How to Restrict User Access to a Folder or Drive in Windows 11
What are “Account Unknown S-1-15-3” and “S-1-5-21” in Windows 11?
S-1-15-3: This SID relates to “app capability SIDs”, which help Windows manage app permissions in an app container. These SIDs are part of how Windows lets apps use certain resources. If you see an “Account Unknown” with this SID, it likely means the app or capability linked to it is gone, but the permission entry is still there. It’s usually not a big deal, but removing these without knowing what you’re doing could mess up some app functions.
S-1-5-21: This is a pretty common SID type that is usually linked to a local user account or group. It typically represents an account that’s already been deleted or isn’t recognized by the system anymore. You often see these after updates, account deletions, or changes in the domain. You can remove these SIDs, but make sure they aren’t linked to any active user accounts, especially in a network where permissions are much more complicated.
Might be useful: How to Remove Microsoft Account From Windows 11/10
Should you worry about “Account Unknown” entries?
In most cases, you shouldn’t worry about “Account Unknown” entries in the file or drive properties. They don’t mean your system is in direct danger or that strangers are getting into your files.
- “Account Unknown” entries usually come from old user accounts that have been deleted.
- They can’t affect your files unless the SID still matches a real user or group on your system.
- These entries mostly appear because of user account deletions during updates, changes in network rules, or after someone is removed from a shared setup.
But if you notice these entries after something weird happens on your computer, like strange behavior or unknown software popping up, you should check things out more. Maybe scan for malware or look at recent changes to your system’s user accounts.
How do you remove “Account Unknown” entries?
If you want to clear “Account Unknown” entries from your file or drive permissions, follow the steps below (note that you should not remove the user name with SID S-1-15-3 as it might still be needed by Windows for certain tasks):
- Right-click the file, folder, or drive you want to clean up and select “Properties“.
- Go to the “Security” tab and click on the “Advanced” button.
- In the Advanced Security Settings window, click the “Change permissions” button.
- Select the “Account Unknown” entry you want to remove, then click the “Remove” button.
Linked issue: Windows 11 Security Tab Missing in Properties
How can “Account Unknown” entries affect file sharing and permissions?
If you share your computer with others, like at work or at home, “Account Unknown” username can sometimes be confusing. For example, when you share files or folders, these unknown accounts might show up as having access, which could worry others.
“Account Unknown” entries only matter if the SID still matches a real user or group. But keeping these can make your permissions list messy.
Occasionally, if the “Account Unknown” SID still matches a valid user somewhere else, it could keep its permissions. Always check the SID properly before removing it in a shared setting.
What if you see “Account Unknown” after a Windows update?
System updates can trigger “Account Unknown” entries to show up, especially if the update changes user accounts, group policies, or permissions.
- Windows updates might delete old or inactive user accounts not needed anymore, but their SIDs could still be in your file permissions.
- If your computer is part of a domain, changes in group policy during an update might leave old SIDs as “Account Unknown” entries.
- Some programs removed during an update might leave behind user accounts or groups, leading to these unknown entries.
If you notice these entries after an update, it’s usually okay to remove them, especially if you see no bad effects on how your system works or accesses files.
Research the SID if you’re not sure
Every SID is unique, and you can look it up online to see if it links to a known user or group. If it’s linked to something important, you might decide not to delete it.
