Windows 11 In-Place Upgrade Blocked After Service Authentication Context Change

Anonimowe
2025-07-04T23:21:36+00:00

Environment Details

  • Source OS: Windows 10 Pro 22H2 (Build 19045.6036)
  • Target OS: Windows 11 Pro (latest .iso)
  • Hardware: TPM 2.0 enabled, Secure Boot enabled, UEFI
  • Domain: Workgroup (local machines)
  • Upgrade Method: Setup.exe /auto upgrade /eula accept

LOGS from installation - OneDrive Logs

Problem Statement

Windows 11 in-place upgrade consistently fails after a third-party service was initially configured with user account authentication and later reconfigured to LocalSystem. Despite complete service removal, the upgrade process fails during compatibility assessment.

Service Configuration Timeline Original Working State

  • Service: [ThirdPartyService]
  • Log On As: Local System account
  • Result: Windows 11 upgrade succeeds

Problem Configuration

  • Service: [ThirdPartyService]
  • Log On As: This account
  • Username: [local user account]
  • Password: [provided]
  • Result: Windows 11 upgrade fails

Current State (Still Failing)

  • Changed back to: Local System account
  • Service stopped and disabled
  • Service completely uninstalled and removed
  • Result: Windows 11 upgrade still fails

What I've Already Tried

Please assume I've applied every solution from the first 20 pages of Google, Bing, DuckDuckGo and Yandex. I'm not a novice and have exhausted standard troubleshooting procedures including:

  • ✅ sfc /scannow and DISM /RestoreHealth
  • ✅ Windows Update troubleshooter and reset
  • ✅ Manual Windows Update service restart/reset
  • ✅ Registry cleanup of obvious service entries
  • ✅ Temp file cleanup and disk cleanup
  • ✅ Antivirus disabling during upgrade
  • ✅ All Windows 11 compatibility requirements verified
  • ✅ Memory test and hardware diagnostics
  • ✅ Different upgrade methods (/auto upgrade, /eula accept, compat /ignorewarning, migneo /disable and many others, various combinations)
  • ✅ Upgrade advisor tools and PC Health Check
  • ✅ Event log analysis for obvious error patterns
  • ✅ Even debugging windows kernel while upgrading through network

Core Technical Question

What persistent authentication artifacts remain in Windows after changing a service from user account authentication back to LocalSystem that could block Windows 11 upgrade compatibility assessment?

I suspect the issue relates to:

  1. LSA Secrets - encrypted service account credentials persisting in registry
  2. Security Identifier (SID) artifacts - service-specific SIDs remaining in system databases
  3. File system ACL modifications - NTFS permissions retaining references to deleted service accounts
  4. Authentication context inconsistencies - security token artifacts causing compatibility assessment failures

But i'm more Linux guy and i don't have deep knowledge about how Windows actually works. And the issue is very strange for me - please help.

Microsoft 365 i pakiet Office | Instalacja, realizacja, aktywacja | Inne | Inne

Pytanie zablokowane. To pytanie zostało zmigrowane ze społeczności pomocy technicznej firmy Microsoft. Możesz zagłosować, czy pytanie jest pomocne, ale nie możesz dodawać komentarzy ani odpowiedzi, ani też śledzić pytania.

Komentarze: 0

Odpowiedzi: 11

Sortuj według: Najnowsze
Najbardziej pomocne Najnowsze Najstarsze
  1. Anonimowe
    2025-07-06T13:27:19+00:00

    Hi Patryk,

    Thanks again for the detailed follow-up your methodical approach is truly commendable. You've done a fantastic job clearing out the unnecessary SIDs and verifying the profile registry keys. You're right at this point, we've exhausted the surface-level cleanup and it's clear the issue is rooted deeper. Since the upgrade still fails after ACL and registry sanitization, I agree it’s time we pivot our strategy.

    Here’s what I recommend next:

    1.In-Place Upgrade with Full Logs Captured

    Use the Windows 11 ISO and perform an in-place upgrade (not via Windows Update), while enabling logging:

    -Run the setup.exe from the ISO and choose keep files and apps

    -Let it fail again, then check C:$WINDOWS.~BT\Sources\Panther\setuperr.log and setupact.log

    These logs often hold exact blockers like driver compatibility, app reparse points, or permission issues.

    2.DISM Log Deep Dive

    Since DISM /RestoreHealth hasn’t shown corruption, check %windir%\Logs\DISM\dism.log for suppressed errors or missing manifest issues. Occasionally, minor inconsistencies don't show up unless viewed here.

    3.Offline Servicing (Optional but Advanced)

    If logs show a specific issue, we might prep the install image offline with DISM and inject fixes before the upgrade attempt.

    Warm regards,

    Cherrelyn

    Czy ta odpowiedź była pomocna?

    Komentarze: 0
  2. Anonimowe
    2025-07-06T07:09:36+00:00

    Hi Cherrelyn,

    Thank you for the additional suggestions. I've completed the registry analysis you recommended:

    I've thoroughly examined HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList and found all profiles are legitimate:

    • System profiles: S-1-5-18 (SYSTEM), S-1-5-19 (LOCAL SERVICE), S-1-5-20 (NETWORK SERVICE)
    • User profile: S-1-5-21-1557056498-1580817122-3087789175-1001 (User)
    • SQL Server profiles: SQLTELEMETRY, MSSQLFDLauncher, MSSQLSERVER service profiles

    None of the problematic SIDs we identified in the ACL scan have corresponding entries in ProfileList.

    Current Status:

    • ✅ Removed 8 problematic SIDs from ACL entries across the system
    • ✅ Verified no orphaned profiles in registry
    • ✅ Confirmed all S-1-5-21-* SIDs correspond to valid accounts
    • ❌ Windows 11 upgrade still fails with identical error

    At this point, I'm starting to feel like we're both taking somewhat blind approaches to this issue. The standard SID cleanup and registry verification steps haven't resolved the core problem, and I suspect we need to pivot our troubleshooting strategy.

    Best regards,
    Patryk

    Czy ta odpowiedź była pomocna?

    Komentarze: 0
  3. Anonimowe
    2025-07-06T00:04:43+00:00

    Hi Patryk,

    Thanks for the detailed output and it’s very thorough! From what I see, you’ve identified a good number of capability, appcontainer, and local system/service SIDs, along with some that may be problematic.

    Please try these suggestion next:

    1.Cross-check those problematic SIDs against HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Look for any services with matching names or references, and if confirmed unused, export and then delete those keys.

    2.For lingering profiles in the registry:

    Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, and remove any profile keys that:

    -Don’t correspond to existing user folders in C:\Users

    -Are not linked to active accounts on your machine

    3.If any of those S-1-5-21-* domain/user SIDs aren't tied to known users (net user), feel free to clean them up via icacls as mentioned earlier.

    Warm regards,

    Cherrelyn

    Czy ta odpowiedź była pomocna?

    Komentarze: 0
  4. Anonimowe
    2025-07-05T22:06:11+00:00

    I made some scripts to analyze this, here is output:

    SID EXTRACTOR - extracting all SIDs from file 

Input file: F:\sid_scan_results.txt 

Found SIDs: 

Total: 386 

Unique: 193 

=== ALL SIDS === 

1. S-1-15-2-1083666204-94104884-4233206613-1271453470-922726920-1064507403-787610193 

2. S-1-15-2-1255970798-2717750985-493741290-1721212560-3530798636-1829112236-3118580706 

3. S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 

4. S-1-15-2-138780814-3997110584-2874353029-2041838810-3659441231-3169655024-3643974355 

5. S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394 

6. S-1-15-2-1443768658-4142614663-2184295616-261691820-2296379425-3814639016-258098527 

7. S-1-15-2-1484987186-1222498055-1895867193-3865138943-3428356477-682207028-3900627692 

8. S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708 

9. S-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 

10. S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 

11. S-1-15-2-1862275542-1254060742-1006630753-971163975-25177346-1977832528-4247160915 

12. S-1-15-2-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 

13. S-1-15-2-1910091885-1573563583-1104941280-2418270861-3411158377-2822700936-2990310272 

14. S-1-15-2-1912509539-3368118754-2471371924-3037708167-1407372224-1099830378-371392376 

15. S-1-15-2-19479607-1015771884-3827151630-3301822711-2267158487-4079414233-1230461222 

16. S-1-15-2-1985293208-2541866392-1062781073-2074970810-2161247384-1946888202-708359737 

17. S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934 

18. S-1-15-2-2181377398-65118716-3454236486-3173511759-2711617951-3120918280-1642988593 

19. S-1-15-2-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 

20. S-1-15-2-2318589919-1124213961-2387304886-2541150374-3466323264-3122450703-1138223175 

21. S-1-15-2-2434737943-167758768-3180539153-984336765-1107280622-3591121930-2677285773 

22. S-1-15-2-2473817148-3930944034-1235795307-187980641-3967865409-1804095407-1113801530 

23. S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 

24. S-1-15-2-2652307757-2298579837-578647688-3387406430-2756081349-614783772-2601174805 

25. S-1-15-2-2668987081-2569674137-3179742174-4270009011-3803107086-2981642713-3349210623 

26. S-1-15-2-2705751783-1496458293-2835996032-3143071717-1071345625-677459937-2760321769 

27. S-1-15-2-2758101530-1321080646-1475665648-4066602542-2880396197-3643791541-2654759312 

28. S-1-15-2-283421221-3183566570-1718213290-751554359-3541592344-2312209569-3374928651 

29. S-1-15-2-284907560-3695622717-2124867970-90980536-1928201052-1028515541-1033863524 

30. S-1-15-2-2932635078-2083127429-3588030127-3048655639-78464744-446804135-4255923089 

31. S-1-15-2-3024644944-341862885-1170623225-3544868822-2883921911-975687952-948131898 

32. S-1-15-2-3024871829-3976948118-2663862959-2402944110-3647003743-4018965598-3259370425 

33. S-1-15-2-3072599432-1607568789-957273504-856596282-71567818-1546726304-1084662928 

34. S-1-15-2-3110756066-2507771734-389907848-353554127-1230786711-3973453966-120447785 

35. S-1-15-2-3119458392-1009845475-4083330090-3659807469-4003170139-1239840055-303833190 

36. S-1-15-2-3127391486-654165588-1135944943-943820645-244210695-3344878592-833444881 

37. S-1-15-2-3147918054-4251542582-2404553452-1793583264-1546801782-1235146273-4024180735 

38. S-1-15-2-3155986392-3975291318-3290200901-3688105942-3149078057-1179077593-1847296678 

39. S-1-15-2-3261124336-967904692-548716175-2724082555-235625598-1533749622-1468861831 

40. S-1-15-2-3403125134-424443074-1489734032-3328068408-1744204695-205958814-4102323917 

41. S-1-15-2-3454040486-2837767420-2398300611-2444005331-4037059961-341738144-1918557667 

42. S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723 

43. S-1-15-2-3560616614-2443124858-2671974668-1543263898-3536119268-1279657150-1433109665 

44. S-1-15-2-3733603082-4179795269-1217541644-381468798-1681740699-3059609168-2054985149 

45. S-1-15-2-376394652-561073501-3860281203-1504987455-3700908885-838405406-2815224885 

46. S-1-15-2-3784866113-3187381476-3433752343-3391928953-3760210436-1684329488-1912184601 

47. S-1-15-2-3828360675-3123616087-1283226262-1036109304-3961725198-2080846782-1645323766 

48. S-1-15-2-3911328773-608413955-1309177842-678056087-3306350038-3682494511-2300153425 

49. S-1-15-2-3912597219-1073764063-4221279274-2430493127-3107599948-1184173955-951593363 

50. S-1-15-2-4264928162-86341590-2006646042-3756743162-890444002-3415177634-881149292 

51. S-1-15-2-447965956-1595884426-2614601585-2128949372-556907266-1570989533-1058743812 

52. S-1-15-2-515815643-2845804217-1874292103-218650560-777617685-4287762684-137415000 

53. S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757 

54. S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984 

55. S-1-15-2-577703620-721806600-2575725278-1938300505-2177978512-2240326487-1220425747 

56. S-1-15-2-58910866-3222973021-3644791724-2336003105-2142029753-2093886826-3648459896 

57. S-1-15-2-899261656-4055568758-2400112791-3940088751-3987735885-2174448918-1852080545 

58. S-1-15-2-932905279-1352884144-690731472-1935380077-77221151-3040906485-3167188873 

59. S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523 

60. S-1-15-2-957941444-2271171641-4049211970-804197638-2225746618-2474488012-4131196493 

61. S-1-15-2-969871995-3242822759-583047763-1618006129-3578262429-3647035748-2471858633 

62. S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949 

63. S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622 

64. S-1-15-3-1024-1528657515-1944437972-2795272136-1227674495-293963776-353393192-4060142787-1908764039 

65. S-1-15-3-1024-2302894289-466761758-1166120688-1039016420-2430351297-4240214049-4028510897-3317428798 

66. S-1-15-3-1024-2440306377-3304611049-1494399071-1161926223-163912384-1437065773-1456820560-2390158196 

67. S-1-15-3-1024-3035980445-2343077072-2039973919-2593655016-2336600711-3402322490-2613491542-1611519126 

68. S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187 

69. S-1-15-3-1024-3167453650-624722384-889205278-321484983-714554697-3592933102-807660695-1632717421 

70. S-1-15-3-1024-3424233489-972189580-2057154623-747635277-1604371224-316187997-3786583170-1043257646 

71. S-1-15-3-1024-3635283841-2530182609-996808640-1887759898-3848208603-3313616867-983405619-2501854204 

72. S-1-15-3-1024-395641907-2340533657-1796656376-1949871151-3167452726-3934347287-2361051074-3061173417 

73. S-1-15-3-1024-4044835139-2658482041-3127973164-329287231-3865880861-1938685643-461067658-1087000422 

74. S-1-15-3-1024-70329670-3585251103-1149629936-3204666536-4257240719-2613976102-450591375-1666047922 

75. S-1-15-3-1024-989523358-1667815365-316973287-129935811-3358257576-2796868252-2781088163-715581871 

76. S-1-15-3-1129327095-991559893-3313040786-1668363957-4272635352-1478159312-1344194511 

77. S-1-15-3-1137361305-1944930389-4265887398-1762068309-215038392-1929499672-501504109 

78. S-1-15-3-1200919149-3496382043-3330813021-2587244570-2180349009-3091249925-2154660869 

79. S-1-15-3-1239072475-3687740317-1842961305-3395936705-4023953123-1525404051-2779347315 

80. S-1-15-3-1255970798-2717750985-493741290-1721212560-3530798636-1829112236-3118580706 

81. S-1-15-3-1288279408-4010470124-2163985056-447644096-1946037256-752919663-3751275627 

82. S-1-15-3-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646 

83. S-1-15-3-138780814-3997110584-2874353029-2041838810-3659441231-3169655024-3643974355 

84. S-1-15-3-1443768658-4142614663-2184295616-261691820-2296379425-3814639016-258098527 

85. S-1-15-3-1484987186-1222498055-1895867193-3865138943-3428356477-682207028-3900627692 

86. S-1-15-3-1519153344-717422182-3767175692-1118150562-4047497999-3652784684-536602263 

87. S-1-15-3-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708 

88. S-1-15-3-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157 

89. S-1-15-3-1714399563-1326177402-2048222277-143663168-2151391019-765408921-4098702777 

90. S-1-15-3-1726375552-1729233799-74693324-3851689839-2151781990-3623637752-3611872497 

91. S-1-15-3-1794666530-1473249818-1588996214-3976422419-3023849891-1013843484-2185627956 

92. S-1-15-3-1823635404-1364722122-2170562666-1762391777-2399050872-3465541734-3732476201 

93. S-1-15-3-1862275542-1254060742-1006630753-971163975-25177346-1977832528-4247160915 

94. S-1-15-3-1880626798-2296700190-2192216202-2581987570-949377748-777141861-2889999867 

95. S-1-15-3-1910091885-1573563583-1104941280-2418270861-3411158377-2822700936-2990310272 

96. S-1-15-3-1912509539-3368118754-2471371924-3037708167-1407372224-1099830378-371392376 

97. S-1-15-3-1930852602-715273891-2259524165-1460409268-4224052142-2029744616-1797406285 

98. S-1-15-3-1931169351-620762451-4266354692-1289171459-249431657-520504113-4121106084 

99. S-1-15-3-19479607-1015771884-3827151630-3301822711-2267158487-4079414233-1230461222 

100. S-1-15-3-1985198343-3186790915-4047221937-1969271670-3792558349-1325541827-400269725 

101. S-1-15-3-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330 

102. S-1-15-3-2170368577-2832618083-4010677670-1544713165-1897091468-198811489-3498314906 

103. S-1-15-3-2181377398-65118716-3454236486-3173511759-2711617951-3120918280-1642988593 

104. S-1-15-3-2188130720-2839601841-3157732644-2592691638-1140003976-1644640269-1870447086 

105. S-1-15-3-2226957697-3030467180-2301525-4248967783-2024719031-2325529081-2915787518 

106. S-1-15-3-2246242352-370130666-2593524754-1827188282-2313440240-2317694540-2761805292 

107. S-1-15-3-2246530975-808720366-1776470054-230329187-4153223113-3550430174-4193313734 

108. S-1-15-3-2376884767-3641813526-1736181949-1293975252-228260496-2789807194-3363476418 

109. S-1-15-3-2434737943-167758768-3180539153-984336765-1107280622-3591121930-2677285773 

110. S-1-15-3-2473817148-3930944034-1235795307-187980641-3967865409-1804095407-1113801530 

111. S-1-15-3-2551677095-2355568638-4209445997-2436930744-3692183382-387691378-1866284433 

112. S-1-15-3-2603511428-3224021693-1028932517-3941269705-3349582775-2312504883-4057327947 

113. S-1-15-3-2652307757-2298579837-578647688-3387406430-2756081349-614783772-2601174805 

114. S-1-15-3-2668987081-2569674137-3179742174-4270009011-3803107086-2981642713-3349210623 

115. S-1-15-3-2679466428-2257802901-1755839644-3032159574-3452485508-990264208-3332697187 

116. S-1-15-3-2705751783-1496458293-2835996032-3143071717-1071345625-677459937-2760321769 

117. S-1-15-3-2758101530-1321080646-1475665648-4066602542-2880396197-3643791541-2654759312 

118. S-1-15-3-284907560-3695622717-2124867970-90980536-1928201052-1028515541-1033863524 

119. S-1-15-3-2933159774-2260684925-3446417023-3370109328-4114987173-657826472-3173302891 

120. S-1-15-3-2967553933-3217682302-2494645345-2077017737-3805576244-585965800-1797614741 

121. S-1-15-3-3072599432-1607568789-957273504-856596282-71567818-1546726304-1084662928 

122. S-1-15-3-3110756066-2507771734-389907848-353554127-1230786711-3973453966-120447785 

123. S-1-15-3-3119458392-1009845475-4083330090-3659807469-4003170139-1239840055-303833190 

124. S-1-15-3-3127391486-654165588-1135944943-943820645-244210695-3344878592-833444881 

125. S-1-15-3-3132517012-1571311091-3263739450-2968124769-4061529133-2106415361-233808003 

126. S-1-15-3-3147918054-4251542582-2404553452-1793583264-1546801782-1235146273-4024180735 

127. S-1-15-3-3155986392-3975291318-3290200901-3688105942-3149078057-1179077593-1847296678 

128. S-1-15-3-3173323527-1370142926-3440071442-4097462880-1944842275-2641970605-339160986 

129. S-1-15-3-3261124336-967904692-548716175-2724082555-235625598-1533749622-1468861831 

130. S-1-15-3-3445883232-1224167743-206467785-1580939083-2750001491-3097792036-3019341970 

131. S-1-15-3-3469964869-263285312-1618360021-2343290171-1786798556-2722298370-1585569900 

132. S-1-15-3-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723 

133. S-1-15-3-3539788797-2700867667-1432428195-1581642-2885308443-3834444517-2495346167 

134. S-1-15-3-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194 

135. S-1-15-3-3733603082-4179795269-1217541644-381468798-1681740699-3059609168-2054985149 

136. S-1-15-3-3739514657-3828455176-2936196785-2025316370-1894713875-3268641221-1640234959 

137. S-1-15-3-3784866113-3187381476-3433752343-3391928953-3760210436-1684329488-1912184601 

138. S-1-15-3-3795941342-518727550-4290142327-3574433603-4273787745-1450327651-649988109 

139. S-1-15-3-3796023949-4038212634-1714623181-2493522191-3401103819-2606702667-1286878354 

140. S-1-15-3-3828360675-3123616087-1283226262-1036109304-3961725198-2080846782-1645323766 

141. S-1-15-3-3911328773-608413955-1309177842-678056087-3306350038-3682494511-2300153425 

142. S-1-15-3-3912597219-1073764063-4221279274-2430493127-3107599948-1184173955-951593363 

143. S-1-15-3-3981118486-977731610-4260702232-2292029000-2544493239-2660358776-1526570402 

144. S-1-15-3-4080526894-3737875801-2191701479-3029442028-1595523745-40875543-2485833908 

145. S-1-15-3-4096 

146. S-1-15-3-4153522205-3718366397-1353898457-1332184198-1210887116-3116787857-2103916698 

147. S-1-15-3-4264928162-86341590-2006646042-3756743162-890444002-3415177634-881149292 

148. S-1-15-3-447965956-1595884426-2614601585-2128949372-556907266-1570989533-1058743812 

149. S-1-15-3-466767348-3739614953-2700836392-1801644223-4227750657-1087833535-2488631167 

150. S-1-15-3-515815643-2845804217-1874292103-218650560-777617685-4287762684-137415000 

151. S-1-15-3-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984 

152. S-1-15-3-550378684-1537206484-183059731-190685656-3791983998-2183447881-322861850 

153. S-1-15-3-567501097-281763132-502764112-1855211022-3143306454-2372101908-561929011 

154. S-1-15-3-577703620-721806600-2575725278-1938300505-2177978512-2240326487-1220425747 

155. S-1-15-3-58910866-3222973021-3644791724-2336003105-2142029753-2093886826-3648459896 

156. S-1-15-3-599759058-3479938838-1253218824-33263930-1483063708-2104800716-3218279855 

157. S-1-15-3-65536-3852923496-3228631905-2361761901-1328441031-2492177081-392074989-583479735-4232454157 

158. S-1-15-3-899261656-4055568758-2400112791-3940088751-3987735885-2174448918-1852080545 

159. S-1-15-3-930279079-3258969966-1203931420-3379063298-1496040207-3203565093-3038441310 

160. S-1-15-3-932905279-1352884144-690731472-1935380077-77221151-3040906485-3167188873 

161. S-1-15-3-937955258-4038542540-364486478-666379738-3697399013-431555883-24972786 

162. S-1-15-3-957941444-2271171641-4049211970-804197638-2225746618-2474488012-4131196493 

163. S-1-15-3-969871995-3242822759-583047763-1618006129-3578262429-3647035748-2471858633 

164. S-1-19-0-0 

165. S-1-19-512-4096 

166. S-1-5-21-1557056498-1580817122-3087789175-1000 

167. S-1-5-21-1567539859-3607284760-1028510636-1001 

168. S-1-5-21-2015320852-1265445608-668619344-1001 

169. S-1-5-21-2143645096-2390711400-262365623-1001 

170. S-1-5-21-2554176643-417975325-1090196125-1001 

171. S-1-5-21-263178083-4045568773-670798866-1001 

172. S-1-5-21-2881396566-2188883231-1969653488-1001 

173. S-1-5-21-2915108487-101117868-835088639-1001 

174. S-1-5-21-3097349143-338958085-3456603351-1001 

175. S-1-5-21-3266258307-3096599518-1037722679-1001 

176. S-1-5-21-3432470361-3778956016-247022381-1001 

177. S-1-5-21-3875148324-1780856060-3390162223-500 

178. S-1-5-21-3933942852-973373972-2766786355-1032 

179. S-1-5-21-3933942852-973373972-2766786355-500 

180. S-1-5-21-4245708023-3611132008-3465708905-1001 

181. S-1-5-21-701530358-3513798897-359453745-1001 

182. S-1-5-21-831935616-2362133858-3479552362-1001 

183. S-1-5-32-3035980445-2343077072-2039973919-2593655016-2336600711-3402322490-2613491542-1611519126 

184. S-1-5-32-70329670-3585251103-1149629936-3204666536-4257240719-2613976102-450591375-1666047922 

185. S-1-5-32-989523358-1667815365-316973287-129935811-3358257576-2796868252-2781088163-715581871 

186. S-1-5-80-2066226495-3997108304-3880305899-3645215860-1263843924 

187. S-1-5-80-2943419899-937267781-4189664001-1229628381-3982115073 

188. S-1-5-80-3579033775-2824656752-1522793541-1960352512-462907086 

189. S-1-5-80-3906544942-1489856346-3706913989-164347954-1900376235 

190. S-1-5-80-89244771-1762554971-1007993102-348796144-2203111529 

191. S-1-5-87-1060603329-121822201-3452730971-4292368946-61207722 

192. S-1-5-87-1452649159-2109950929-2856838567-3638795029-1283063528 

193. S-1-5-87-1469317444-2401623638-2778953283-1691679301-3481717153 

SIDs saved to: F:\extracted_sids.txt 

=== SID TYPE ANALYSIS === 

Capability: 101 

AppContainer: 62 

Well-Known: 28 

Domain User/Computer: 17 

Service: 5 

Local Computer: 3 

=== POTENTIALLY PROBLEMATIC SIDs === 

Found potentially problematic SIDs: 

- S-1-19-0-0 

- S-1-19-512-4096 

- S-1-5-80-2066226495-3997108304-3880305899-3645215860-1263843924 

- S-1-5-80-2943419899-937267781-4189664001-1229628381-3982115073 

- S-1-5-80-3579033775-2824656752-1522793541-1960352512-462907086 

- S-1-5-80-3906544942-1489856346-3706913989-164347954-1900376235 

- S-1-5-80-89244771-1762554971-1007993102-348796144-2203111529 

- S-1-5-87-1060603329-121822201-3452730971-4292368946-61207722 

- S-1-5-87-1452649159-2109950929-2856838567-3638795029-1283063528 

- S-1-5-87-1469317444-2401623638-2778953283-1691679301-3481717153

    Czy ta odpowiedź była pomocna?

    Komentarze: 0
  5. Anonimowe
    2025-07-05T15:04:07+00:00

    Hi Patryk,

    Thanks for your update! Since the WMI repository is consistent and the registry path doesn’t exist, we’ll focus on orphaned SIDs and leftover service traces.

    Please run this in elevated PowerShell to check for unused SIDs:

    icacls C:\ /T /C | findstr /i "S-1-5-21"

    Compare the SIDs to your active user list—if any don’t match, remove them using:

    icacls "Path" /remove "S-1-5-XX..."

    Next, go to:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

    Look for old service keys related to the one that used a local account. Back them up and delete if confirmed unused.

    Also check:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    Remove unknown SIDs not linked to valid profiles.

    Warm regards,

    Cherrelyn

    Czy ta odpowiedź była pomocna?

    Komentarze: 0