Why do you see Account Unknown S-1-5-21-SID in your Windows 11?

The appearance of “Account Unknown S-1-5-21-SID” in Windows 11 is typically linked to orphaned or unresolved user account references. The following are the reasons.

1. Deleted User Accounts
2. System Migrations or Restorations
3. Domain Account Changes (in Enterprise Environments)
4. Software Installations or Uninstallations
5. Misconfigured User Profiles

When I encounter “Account Unknown S-1-5-21 SID”, should I be worried?

“Account Unknown S-1-5-21” in Windows is not a cause for immediate alarm, however, it depends on the context. For example, if you have recently deleted a user account, or you are viewing old backup or migrated data, or if you encounter this identifier in non-critical locations (usually a sign of outdated or redundant entries), then it may be harmless and not a security issue.

However, if you encounter this identifier in Group Policies, Administrative shares, System Settings, or Registry keys, especially in cases where you did not delete any users, it raises security concerns. This situation requires investigation, cleanup of orphaned entries, and ensuring the system’s security to prevent potential breaches.

Understanding S-1-5-21 SID

Let’s break down this identifier.

• S – Indicates it is an SID.
• 1 – The version of the SID Format.
• 5 – Denotes a predefined identifier authority, specifically the NT Authority.
• 21 – Represents a unique machine or a domain identifier.

Method 1: How to Fix “Account Unknown S-1-5-21” SID on Windows 11?

Before getting into the fix, it is highly recommended to determine why this SID is appearing. It may be just a leftover reference if a user account is deleted. In Domain Environments, the account may have been removed or disconnected from the domain, a backup restoration might have left old permissions linked to a non-existent account, or software might have added service accounts or special user accounts during installation. Here are the steps to fix this.

• Right-click on the File or Folder that shows the Account Unknown S-1-5-21 SID. In my case, it is a folder E Disk.

• Click on Properties. It will open the File or Folder Properties.
• Now, navigate to the Security tab.

• Click Advanced to open the advanced security settings.

• You can find the Change Permissions button. Click on that.

• Look for the “Account Unknown S-1-5-21” entry in the Permissions list. Select it and then click Remove.

• Now, the account will be removed. Finally, click Apply.

• Windows will update the security information. Kindly be patient.

• Once it completes the process, that is it. You can close the window.
• Reopen the same folder Properties again. Now, you can find that the Account Unknown S-1-5-21 has been removed.

Video walkthrough for fixing the Account Unknown SID Issue

Method 2: Remove Account Unknown S-1-5-21 using Command Prompt

There is an alternate approach available using the Command Prompt that can be just as efficient, especially for advanced users or when dealing with system-wide issues. This method provides a way to reset permissions or remove the “Account Unknown” entry from specific files or folders effectively.

• Go to the Start menu and search for Command Prompt. Right-click on the Command Prompt and click on Run as Administrator.

• On the CMD, enter the following command and execute it. icacls "C:\Path\To\Folder" /reset

Note: Here, replace the Path to Folder with the actual folder path where the orphaned SID appears.

Method 3: Delete Account Unknown S-1-5-21 Profile using Regedit

In this method, we will use the Windows Registry Editor to remove the S-1-5-21 SID from your Windows 11 PC. Here are the steps.

• We will use the Run command to open Registry Editor. Use the shortcut Win Key + R to open the Run command.
• On the Run, enter the following command regedit and click OK.

• User Account Control will prompt for your confirmation. Click Yes.
• Now, Registry Editor will open. Navigate to the following location, where the Profiles list can be found. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

• Look for the folder (Registry key) that is named S-1-5-21………
• Right-click on the folder and then click Delete.

• Windows will prompt for your confirmation. Click Yes to confirm the deletion. Kindly make sure to delete only the S-1-5-21… Registry Folder.

• That is it. Account Unknown SID will now be removed via the Registry Editor.

Information on the Go!

The S-1-5-13 SID is associated with a special security identifier in Windows that typically represents a restricted user group called “Enterprise Domain Controllers”. This group is specifically used in environments with Active Directory (AD), typically on domain controllers.

Frequently Asked Questions

Take away

In most cases, encountering “Account Unknown S-1-5-21” or similar SIDs on Windows 11 is not a cause for alarm. If the S-1-5-21 SID appears in critical areas like Group Policies, administrative shares, or the Windows Registry, it may indicate a need for cleanup and further investigation to prevent potential threats. Regular maintenance, such as periodic checks for orphaned SIDs, will help ensure that your system remains secure and runs efficiently.

Have Queries?

If you have queries, kindly let us know in the comments. For more interesting articles, stay tuned to Winsides.com. Happy Computing! Peace out!

Key Solutions to BSOD CrowdStrike’s Fix:

• Boot Windows into Safe Mode or the Windows Recovery Environment.
• Go to the C:\Windows\System32\drivers\CrowdStrike directory.
• Find the file matching “C-00000291*.sys”, and delete it and restart your pc.
• Boot your Windows normally.

Why BSOD CrowdStrike Error Occurs:

This BSOD Error happens due to the driver conflicts, software corruptions, & problematic system files.

1. Driver Conflicts:

Sometimes, different software drivers installed on your computer can interfere with each other. This can cause the system to crash and show the BSOD.

2. Software Corruptions:

Certain applications or updates might have bugs or compatibility problems that trigger the BSOD.

3. Problematic System Files:

If important system files are damaged or missing, it can lead to a BSOD error in your Windows 11 pc.

Fixing BSOD CrowdStrike’s Error:

If you encounter the Blue Screen of Death (BSOD) error and can’t move past it, don’t panic. Follow these steps to quickly fix the issue:

• Restart Your Computer: Turn off your PC and then turn it back on. This can help clear temporary problems.

• Boot into Safe Mode or Windows Recovery Mode:
  • Safe Mode: Restart your PC. While it’s starting up, hold down the Shift key and select Restart from the Start menu. Choose Troubleshoot -> Advanced options -> Startup Settings and then click Restart. After your PC restarts, select 4) Enable Safe Mode.
  • Windows Recovery Mode: If you can’t get into Safe Mode, restart your PC and press F8 or F11 repeatedly until you see recovery options.

• Find the CrowdStrike Folder: Once you’re in Safe Mode or Recovery Mode, open File Explorer. Go to C:\Windows\System32\drivers\CrowdStrike

• Delete the Problem File: In the CrowdStrike folder, find the file named C-00000291*.sys. It might have a different number, but it will start with C-00000291 and end with .sys. Delete this file.

• Restart Your PC Again: After deleting the file, restart your PC normally.

These steps should fix the BSOD error and let you use your PC as usual. If the problem continues, you might need to follow the below solutions. Follow the steps below so that We can prevent this kind of issues happening in futures!

Updating the Drivers:

• Use the Keyboard Shortcut Win + X and select the “Device Manager.” This will show all the hardware connected to the PC.

• Simply look for devices marked with a yellow exclamation mark, which is indicating a driver issue.

• You need to Right click the device with the problem and select “Update driver.” And you need to choose “Search automatically for updated driver software” to let Windows find the latest version online.

• If Windows doesn’t find a new driver, you need to visit the device manufacturer’s website. Download and install the latest driver manually.

Run System File Checker

• You need to use the keyboard shortcut Win + S, type cmd, right-click “Command Prompt,” and choose “Run as administrator.”

• Enter the command sfc /scannow in the command prompt and press Enter button. The scan will start and may take some time.

• After the scan finishes, it will show whether it found and fixed any corrupt files. Restart the PC afterward.

• If SFC doesn’t repair all files, use the Deployment Imaging Service and Management Tool (DISM). Type DISM /Online /Cleanup-Image /RestoreHealth in the command prompt.

Perform a Clean Boot:

• Use the keyboard shortcut Win + R, type msconfig, and press Enter.

• Go to the “Services” tab, check “Hide all Microsoft services,” and click “Disable all.”

• Now you need to goto the “Startup” tab and click “Open Task Manager.” Disable all listed startup items.

• Return to the System Configuration window, click “Apply,” then “OK,” and restart the computer.
• After restarting, use the PC normally. If the BSOD doesn’t appear, re-enable services and startup items one by one to identify the problem.

Conclusion:

By following these steps, anyone can often solve BSOD CrowdStrike issues and get their system back to normal. I’ve shown how to update drivers, remove troublesome software, and run system checks to keep everything running smoothly. Checking for Windows updates and performing a clean boot can also help identify and fix the problem.

Why this Error Occurs:

I found that my Windows 11 Home edition is the cause of this problem. Microsoft, by default it disables the Group Policy editor for Home edition and only available for the Windows 11 Pro, Windows 11 Enterprise, Windows 11 Education.

Fortunately, I found a simple two-step fix to enable the Group Policy Editor on Windows 11 Home edition. I have discovered two ways to resolve the issue and make the Group Policy Editor accessible on Home editions. Please use the method that is most convenient for you.

• Enable gpedit.msc using Batch File.

Enable gpedit.msc using Batch File:

Creating a Batch File:

• You need to open Notepad on your Windows 11 Home edition PC.
• Now you need to Copy and paste the following code into Notepad

@echo off
pushd “%~dp0”

dir /b %SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~3.mum >List.txt dir /b %SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~3.mum >>List.txt

for /f %%i in (‘findstr /i . List.txt 2^>nul’) do dism /online /norestart /add-package:”%SystemRoot%\servicing\Packages\%%i”
pause

gpedit.msc Enabler batch file.

• Alternatively, you can download the gpedit.msc bat file enabler here. The bat file is completely safe and verified by Virustotal for your concern.

Saving the Batch File:

• Now you need to save the file with a .bat extension. For example, name it gpedit-enabler.bat file.
• Alternatively, Choose “All Files” from the “Save as type” dropdown menu, and then save the file to your location.

Run the Batch File as Administrator:

• You need to Right click the batch file you just created.
• Now you need to Select “Run as administrator” from the context menu as shown in the below image.

• Immediately, the batch file will initiate its process, and in less than a minute, you should see a message saying “The operation completed successfully” in the command prompt. The Group Policy Editor will then be activated on your Home edition.

Once you see the message shown in the image above, you can be assured that the issue has been fixed on your Home Edition PC.

Verify gpedit.msc has been fixed:

• Use the Win + R shortcut to open the Run dialog.
• Now you need to enter the command gpedit.msc and press Enter button.

Conclusion:

After encountering the error message when trying to access gpedit.msc, I used the batch file method to enable the Group Policy Editor on my Windows 11 Home edition. The process was simple and quick, and within minutes, I received the confirmation message indicating that the operation was successful. Now, with gpedit.msc activated, This 2 step fix resolved the issue, allowing me to manage my system settings as needed. If you face the same problem, I recommend using this method to enable the Group Policy Editor on your Home edition PC. Find more at Winsides.com