There are multiple TEMP* accounts in \Users\ since switching to a limited account

Question

Ever since I switched my normal Windows 7 user account to a limited account (for some reason, the default is an admin account ◔_◔), there have been multiple TEMP* accounts accumulating in C:\Users. Here are a few facts:

• The first one was simply called TEMP, the second is named TEMP. Foobar (where foobar is the computer name), then TEMP.Foobar.000 and so on.
• The current batch of foreign accounts seem to all have been created the last time I rebooted (give or take a few hours).
• Some of them have a few files, some have more, and some have no files at all (just a couple of empty folders).
• The files and folders contained in the unexplained accounts don’t seem to be of much diagnostic help because they are general Microsoft/Windows stuff that any new account would likely have.
• This all began after switching my main account to a limited account.
• There is only one admin-level account on the system, and it already has its directory in C:\Users.
• Whenever I get the UAC dialog, I enter the password for the (only) admin-level account.
• Some of the prompt for admin privileges to access their contents, some don’t.
• The first two can be deleted, but the last one is in use.
• The one that is in use has locked files by the following:
  • Task Manager
  • SpeedFan
  • LSASS which hosts the following services:
    • Credential Manager
    • CNG Key Isolation
    • Encrypting File System
    • Security Accounts Manager

What information I have been able to find seems to indicate that it has something to do with creating a temporary account for elevation purposes, but that doesn’t make sense because I am using the existing admin-level account for that, so it should not be creating a new, temporary account. This is probably the reason that I cannot seem to get the Task Manager settings to stick; when I set them, they only affect the currently used admin, temporary account, but when I reboot, a new one is used, so the previous settings are lost.

This is really frustrating and I find it baffling that using a limited account would be such hard work and difficult to make work because it promotes just giving up and using a privileged account for day-to-day work.

Does anybody have any concrete information about why/where/when/how all these TEMP accounts are being created and how to stop it? Conversely, can anyone explain why Windows keeps creating new, temporary accounts for elevating instead of using the existing admin account even though it is specifically be used?

Answer 1

I thought I was going to get to bed early last night, but thanks to this, I ended up staying up until 5:30am and got almost 90 whole minutes of sleep. After a lot of poking around, monitoring, web-searching, and experimentation, I fixed it.

I discovered that the default administrator account had no files. Somehow its profile (not the registered account, but the actual on-disk files) were missing. I’m not sure how it happened, presumably something went wrong while I was trying to harden and lock down Windows, but the directory was in fact, not actually present on the drive. This is congruent with information about temporary profiles. (Some of the confusion may have stemmed from the fact that when I deleted a previous similarly-named admin account I had created in an effort to have admin access without using the built-in account, Windows had decided to leave the profile behind instead of deleting it.)

Unfortunately there does not seem to be any information on the Internet on re-creating the built-in administrator account (most of the information is simply about enabling it).

One option would be to copy the directory from a freshly-installed copy of Windows 7 or the installation disc, but unlike with FAT, NTFS has permissions and other meta-data which may be involved and so complicates a simple file-copy.

I decided to copy the default-user profile since that is what Windows does whenever you create a new account (figure 1):

1. Run SystemPropertiesAdvanced
2. Click the [Settings] button next to User Profiles
3. Select the Default Profile and click [Copy To]
4. Enter the appropriate directory
5. Select the approprtiate user account to set the correct permissions
6. [OK]

Windows copies the default user profile to the administrator account’s directory. Reboot, and Windows should no longer need to use a temporary profile for the administrator account.

Another way to do it is to actually nuke the administrator account because then Windows will indeed re-create it. It sounds scary and suspicious, but it actually worked perfectly:

1. Delete the account’s profile if necessary (e.g., if you have already re-created it yourself)
2. Run the registry editor as admin
3. Navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3517681861-3532196175-3983141175-500
4. Delete it (or just rename it to something else like #S-1-5-21-3517681861-3532196175-3983141175-500
5. Repeat for the backup entry if it exists (i.e., S-1-5-21-3517681861-3532196175-3983141175-500.bak)
6. Reboot into safe-mode
7. Reboot into normal mode

Windows should have re-created the entire Administrator account from scratch when you booted into safe-mode. (It’s interesting to note that Windows actually puts a little more stuff in the new account when you do it this way than when you simply copy the default-user profile, but nothing important, just installed-program related files and directories.)

Hopefully, now whenever someone needs to fix/recreate the built-in administrator account for whatever reason, they can find the information they need.

(As for why there were multiple profiles, it seems that Windows was creating a new one each time I rebooted. Why it didn’t delete the previous temporary profile is beyond me.)

---

Figure 1: Screenshot of produced to copy default-user to administrator