I've run into this issue before, and I had to fresh install windows to remove it last time. I was curious if there's anyone that knows more about it, and if it happened because of a plugin/vst?

They're account numbers that show up on the main drive "account unknown" and then
S-1-15-3-65536-1888954469-739942743-*******************************************-1296943325-355587736-700089176

They make it impossible to install things or find program files. find certain path ways to install programs. if there's a workaround other than restoring my drive. that would be great. because I've already dealt with this before, and I feel very stressed out that it is here again.

 

Those folders are usually managed by Windows (or by Windows Installer, like stuff from the Microsoft Store).

You can of course modify permissions, they default to Administrator (or TrustedInstaller or SYSTEM or somesuch). But as usual, tinkering with anything that has SYSTEM etc. permissions is not necessarily that clever.

I've never encountered a plugin install that did these only Windows itself.

 

It may have been a windows restore point or also my failing drive that was a secondary. I'm not sure what to do when it comes to this. I just want to be able to install things again. Save as new files works, so it just denies paths of install with Error 3.

 

It may have been a windows restore point or also my failing drive that was a secondary. I'm not sure what to do when it comes to this. I just want to be able to install things again. Save as new files works, so it just denies paths of install with Error 3.

 

Seeing SIDs instead of username / groupname means your system cannot link name to SID anymore, which indicate registry corruption (SAM file in this case).

Disk root should have 4 NTFS permissions for 4 groups:
- Authentified users
- Administrators
- Users
- System
You can try to restore your system if you have some restore points, first thing to try -> Run -> rstrui.exe
Maybe you can restore a registry backup as well but you may lose recently created users depending on how old your file is.
Note that this can only be made in offline mode (boot on USB or other system) and you need some IT skills to do it safely.

Lastly, maybe you can try this tool to reset some permissions, but not sure it will fix it.
https://www.tweaking.com/features/windows-repair-all-in-one/
The portable version is recommended.

 

Note that there are SIDs that are "unknown account" while still being valid. Who the fuck knows what MS was thinking here? So while the repair instructions are solid, this might not fix it.

@arthez I think we're going to need more information. If you're getting this a second time, what was done before to create the problem? Was it a certain installer or operation that caused it? And what about now, when and how did this manifest the first time? Also a complete error message, the failing paths, and a list of the permissions of the affected directory would be helpful.

Also, while this might be reaching, is the drive itself fine?

Does it CHKDSK ok?
What does CrystalDiskInfo report?
Is System Restore on? As @yodadl mentioned it might be worthwhile looking at earlier restore points, and in the future, create restore points before installing anything.

Related to system restore, does Shadow Copy (VSS) report errors (Windows uses Shadow Copy internally for System Restore and Backup)?

In Services check "Volume Shadow Copy" and "Microsoft Software Shadow Copy Provider", and in an Administrator CMD you can run "vssadmin list writers" to get a list of errors related to VSS. Also "vssadmin list shadowstorage" to see what drivers are using it, and how much space for backups/restore points is allocated and remaining.

 

not sure what you mean, you can remove user profiles manually like this:

Remove the user’s folder in C:\Users
then delete its corresponding registry entry in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

 

This shouldn't be attempted on system profiles or the active user profile either. Also this does fix or list permissions or security groups, which are the culprit here.

 

Spoiler: Source: ChatGPT KI

It sounds like you're dealing with a Ghost SID (Security Identifier) issue in Windows, which can occur for several reasons, including a faulty plugin/VST or some form of system corruption. These SIDs represent "unknown" or orphaned user accounts, often related to system changes or installations that didn't clean up properly. In your case, the appearance of these SID entries seems to be disrupting your ability to install programs and access paths on your drive.

Potential Causes

1. Plugin/VST-related issues: Some plugins or VSTs can, in rare cases, generate orphaned user accounts or modify system permissions in a way that causes weird SIDs to appear. If the VST plugin is not properly uninstalled, it could leave behind these ghost accounts or permissions issues.
   
   
2. Corruption from software installations/uninstalls: If software, especially drivers or system utilities, is uninstalled improperly, or if an installation process is interrupted, orphaned SIDs can remain, causing instability.
   
   
3. Permissions problems: Windows can sometimes create these phantom accounts due to misconfigured or inherited permissions, especially after system migrations or changes to security settings.
   
   
4. Malware or system exploit: In some cases, malware can alter your system permissions and leave behind such entries as a way of creating access paths that the user cannot see or alter.
   

Workarounds and Fixes:

1. Try to identify the offending SID:
   
   • Open Command Prompt as Administrator.
     
     
   • Run the following command:
     
     cmd
     wmic useraccount where sid='S-1-15-3-65536-1888954469-739942743-*******************************************-1296943325-355587736-700089176' get name
     
   This will attempt to map the SID to a known user name. If this doesn't return anything, the account is likely orphaned and not tied to any active user.
   
   
2. Remove the SID using the Windows Registry:
   
   • Open Regedit (type regedit in the Start menu).
     
     
   • Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
     
     
   • Look for subkeys that begin with S-1-15-3... (matching the SID you're seeing).
     
     
   • If you find one, it’s likely associated with the orphaned user account. Before deleting anything, back up your registry.
     
     
   • Right-click the subkey related to the SID and delete it.
     
     
   • Restart your computer afterward to see if the issue resolves.
     
3. Take ownership of the files/folders:
   
   • If you are having trouble accessing or installing programs due to these SIDs, you can try taking ownership of the affected folders:
     
     1. Right-click the folder or file you want to access.
        
        
     2. Go to Properties > Security > Advanced.
        
        
     3. Under "Owner," click Change.
        
        
     4. Enter your username and apply.
        
        
     5. You should now have full control over the folder, allowing you to modify permissions or delete the SID-related entries.
        
4. Use Safe Mode to fix permissions:
   
   • Boot into Safe Mode by holding Shift and clicking on Restart from the Start menu.
     
     
   • Once in Safe Mode, try to delete or reset the permissions of the problem files, as Safe Mode will often bypass certain system restrictions.
     
5. Check for corruption with SFC and DISM:
   
   • System File Checker (SFC) and Deployment Imaging Service and Management Tool (DISM) can help fix underlying system corruption that might be causing these issues:
     
     • Open Command Prompt as Administrator.
       
       
     • Run:
       
       cmd
       sfc /scannow
       
       
     • Once that completes, run:
       
       cmd
       dism /online /cleanup-image /restorehealth
       
       
     • This should check for and repair any system corruption.
       
6. Backup and Restore:
   
   • If you feel like this issue keeps recurring and no other solution works, a system restore from a previous point (before the issue occurred) could help.
     
     
   • As a last resort, if it's too difficult to resolve, you could create a backup of your important data and perform a clean reinstall of Windows, but I understand you want to avoid that if possible.
     

If you notice this happening repeatedly, it might be worth investigating whether a specific plugin/VST is causing the issue. Try isolating new installations and testing them one by one, checking to see if the issue comes back after a specific one is added. Also, ensuring you have the latest version or patches for any plugins you're using could reduce the likelihood of this happening again.

Let me know if any of these steps help or if you need further guidance!