Deleted Windows 7 user accounts keeps coming back

[sosprepc]

Hi, my client just gave me his laptop for basic repair. There is one issue though, when I want to remove the TEST account created there, it will, but after restart it's back. Same thing is, when I delete password for certain user, it will be deleted as long as I don't restart the computer. I tried clean boot + all the things listed here: https://www.sevenforums.com/tutorials/181036-user-account-delete.html + sfc /scannow + all MB products

I don't have a clue what's going on and where are these users stored. I don't wanna reinstall that much.

I alsto noticed, that when I set, after deleting that account, to restart computer into safe mode, the account stays deleted until next restart without it. Weirdest issue of all times, but something is pretty broken.

Roman

[Firefox]

Lets try getting some logs on that computer to see if someone can review the logs and find something...

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues....
 

1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
2. Download FRST and save it to your desktop
   Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
3. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
4. Press the "Scan" button
5. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   
   • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
     
6. NEXT: Create and obtain an mb-check log
7. Download MB-Check and save to your desktop
8. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK"
9. This will produce one log file on your desktop: mb-check-results.zip
   
   • This file will include the FRST logs generated from the previous set of instructions
   • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area
     
   
   
   

 

[sosprepc]

Okay, here you go.

mb-check-results.zip

...also I should mention, that Windows Updates aren't working because of an unknown issue. Error is saying, that the service isn't running, which is not true at all, I checked. Also I downloaded some fix-tool from official Microsoft site, which doesn't helped either.

Edited March 18, 2018 by sosprepc

[exile360]

Please try the following to see if it fixes Windows Update:

Run the Fix Windows Update Utility:

• Please download the Fix WU Utility from here and save it to your desktop.
• Extract the files and double click on FixWU.exe to run it
• Once it loads click on the Fix Windows Update button
• Once it completes you will see a box that says The process completed successfully, click on OK
• Try updating again
  

As for what keeps bringing the user account back, the only thing I can speculate is that perhaps something is either executing System Restore or is somehow restoring the registry for some reason, though I didn't spot anything in the logs that stood out to me that might do that.  All I can suggest is that you try following the instructions on this page to try to delete the unwanted user account again.  More advanced, manual methods of deleting the account can be found here if that does not work.

I'd also strongly recommend that you remove all installed Java versions from the system.  You may do so manually via Programs and Features or you can use the official Java Uninstall Tool found here.

I hope this helps.  Please let us know how it goes.

Thanks  

 

[sosprepc]

Thank you for that Windows Update fix program. It helped and it really fixed the problem even without restarting the system. Bowing to you sir.

About deleting the users as you said. I tried all the possible ways in the links you posted. Nothing helped, but there are few interesting facts about them. When I try to run lusrmgr - Local Users and Groups - I cannnot manage anything, as this error pops up:

But from here (netplwiz), I can see all the users, including the one that keeps reapearing:

Unfortunately, even after deleting that account from that management, its back after restarting the computer.

 

Deleting Java wasn't successfull too, I tried to uninstall it without the uninstaller first, where I got the following error:

Then I tried their uninstaller that you also posted and also got an error, which is probably connected with broken and non-removable accounts. I would just set up new accounts, but there is no way how I can remove them without reapearing again. I attached the log from the uninstaller below.

I tried to delete and turn off system restore and all the backups there to see if it will help now. I also looked in the user profiles settings and there are only 2 user profiles mentioned:

But I still see 3. In the user folder there is however the folder with the name TEST, which is not deletable. (nopass is name of one user accounts I created)

I also checked the regedit and there are also only 2 profiles mentioned, as I deleted the others from there manually too.

 

I am not sure, what else I could do. Thanks for your valuable reply and I would love to see this Windows update fix in the toolset from malwarebytes.

JavaUninstallTool.log

EDIT: I managed to delete the user “TEST” folder from the “Users” folder on my C:

Even when the peoblematic user is not there anymore, it still shows in the user list.

Edited March 18, 2018 by sosprepc

[exile360]

OK, what happens when you open START>Control Panel>User Accounts and Family Safety>Add or remove user accounts?  Does it show all of the accounts and can you click on one of the accounts you created and aren't currently logged into and delete it?

If not, then perhaps there is a problem with permissions on the system.  You can try Tweaking.com Windows Repair and try using the permissions fixes it contains to see if that resolves the problem.  It has a lot of other fixes as well but that's where I'd start, with the permissions fixes to see if it corrects the issues.

[sosprepc]

It is indeed available there and I am able to delete it, and I do, but after every restart it is back. So I am in this endless loop, it's not like I can't delete it, but "I can't delete it", you know? So when I delete the account through the control panel like you said, it's deleted, even when I log off the account, I can see it is not there.

Then I click on restart and here we are, on the start again. I tried to delete another account and that went off just fine even after restart it was just gone. This one is somehow non-deletable and it's connected to the system itself.

Anwyway, I used Tweaking.com program some time ago and it really fixed even the weirdest problems, so I can give it a shot. Thank you.

[exile360]

This may be extreme, but if Windows Repair doesn't do the trick you might consider performing a repair install of Windows as that is likely to correct the issue and should leave all of the user's personal files and data intact.  The only thing it might break are some of the installed programs, however most of them should still work afterwards and those that don't can easily be reinstalled to repair them.  It is a somewhat drastic measure, but I suspect whatever is causing these issues is some core system component or function that has somehow become corrupted, missing or broken.  You'll need a copy of the Windows version installed on the system, or if the system includes a recovery partition you should be able to use that (just make sure you choose the repair install option, not the reformat/reinstall Windows option).

Before doing all that though, first try the permissions fixes in Windows Repair All-in-One to see if they correct it.  It could simply be that when attempting to delete the accounts, it's failing because of a lack of permissions to remove certain registry keys, files or folders.

[nukecad]

Sorry to stick my nose in,

but is it possible that the client has this laptop synced to some cloud backup service that is automatically restoring the deleted user accounts when you reboot?
Which could also explain why they are not being restored/recreated when you boot in safe mode (or offline?).

I've seen a few instances recently where people complain that files they have deleted keep getting recreated, and i'ts often because they are synced to cloud storage.

[sosprepc]

6 hours ago, nukecad said:

Sorry to stick my nose in,

but is it possible that the client has this laptop synced to some cloud backup service that is automatically restoring the deleted user accounts when you reboot?
Which could also explain why they are not being restored/recreated when you boot in safe mode (or offline?).

I've seen a few instances recently where people complain that files they have deleted keep getting recreated, and i'ts often because they are synced to cloud storage.

That would explain it. But nonsense for me is, that when I try clean boot (no 3th part programs or services started) it happens anyway. It is indeed only in safe-mode without networking. I try to dig deeper and try to find out, if it will be the same when I disconnect the computer from the internet. Thanks.

18 hours ago, exile360 said:

This may be extreme, but if Windows Repair doesn't do the trick you might consider performing a repair install of Windows as that is likely to correct the issue and should leave all of the user's personal files and data intact.  The only thing it might break are some of the installed programs, however most of them should still work afterwards and those that don't can easily be reinstalled to repair them.  It is a somewhat drastic measure, but I suspect whatever is causing these issues is some core system component or function that has somehow become corrupted, missing or broken.  You'll need a copy of the Windows version installed on the system, or if the system includes a recovery partition you should be able to use that (just make sure you choose the repair install option, not the reformat/reinstall Windows option).

Before doing all that though, first try the permissions fixes in Windows Repair All-in-One to see if they correct it.  It could simply be that when attempting to delete the accounts, it's failing because of a lack of permissions to remove certain registry keys, files or folders.

Yep, I have official Windows 7 Professional CD, so I should be able to start repair in the worst scenario. Thank you.

[exile360]

Yeah, I looked in the logs when you first provided them to see if I could spot anything that might roll back the registry and/or files but I didn't notice anything that stood out (aside from the fact that Java is installed; you really should remove that for security when you get the chance  ).

At this point a repair install may be the way to go, and hopefully it will resolve the issues.  I just can't find or think of anything else to try at this point.

[monkeymansam1]

On 3/19/2018 at 7:21 AM, nukecad said:

Sorry to stick my nose in,

but is it possible that the client has this laptop synced to some cloud backup service that is automatically restoring the deleted user accounts when you reboot?
Which could also explain why they are not being restored/recreated when you boot in safe mode (or offline?).

I've seen a few instances recently where people complain that files they have deleted keep getting recreated, and i'ts often because they are synced to cloud storage.

I have had this trouble also with a windows 7 laptop, It is my computer and i used something called "trinity rescue kit" on it to reset a password and i wonder if it backs it up on boot to a network drive so when i restart it always comes back.  I have the exact same issues