There’s a user account on this computer, and no one here remembers creating it.

Read the list

1. Open Settings, Accounts, Other users. Every account except yours is listed under Other users.
2. For the fuller list, right-click Start and open Windows PowerShell, then type Get-LocalUser and press Enter. It returns each account with its name, whether it is Enabled, and a description. It includes the accounts that come built into Windows, so a short list is not the same as a clean one.
3. Type Get-LocalGroupMember -Group Administrators. This is the list of accounts with complete control of the computer, and it is the list that matters most.

What an ordinary list looks like, and what doesn’t

Microsoft describes administrators as accounts with complete control over the system, able to change settings, install software, and reach all files. A standard account can’t do that. That is the difference between an unfamiliar name and an unfamiliar name that can change anything.

• Ordinary: every name belongs to a person who works here or an account that comes with Windows, and the Administrators list is short.
• Look closer: a name that sounds like a role (support, backup, admin followed by a number) that nobody will claim.
• Look closer: an account that is Enabled, belongs to Administrators, and nobody can place.
• Look closer: an account that appeared on several computers at once.

Find who created it, and when

Windows records account creation as event 4720, “A user account was created.” Open Event Viewer, Windows Logs, Security, then choose Filter Current Log and enter 4720.

Each event has a Subject block, the account that asked for the new account to be created, and a New Account block with the name. For a local account, the domain field shows the computer’s name. The event also carries a Logon ID. Matching it to event 4624, “An account was successfully logged on,” shows the sign-in that did the creating.

• Subject is a person you can name, on a day they were working on this computer: the likely story is ordinary.
• Subject is an account nobody can place, or the time matches nothing anyone remembers: keep going.
• No 4720 event at all: this proves nothing either way. The event only exists if account-management auditing was on when the account was made.

Disable before you delete

In Settings, the Remove button clears the account’s sign-in details and its data from the device. That is the evidence you may want. Disabling the account can be undone and removing it can’t.

In an administrator PowerShell window, Disable-LocalUser -Name followed by the account name turns it off. Then ask three things of the people who set up or serviced this computer: who made it, for what, and when it was last used. If a person claims it, enable it again or replace it with one in their own name.

If no one claims it

1. Disable the account, as above, and leave it in place.
2. Change the password on every administrator account on this computer, from a different computer.
3. Check the other computers for the same name and for remote-access programs you didn’t install.
4. Write down the account name, the 4720 time and the Subject name before anyone cleans up.

What this check covers

It covers accounts on one Windows computer. Your Microsoft 365 sign-ins are a separate list, kept in your administrator’s portal, and a clean result here says nothing about them. We look at both with you and tell you what we found and what we didn’t, with dates.

An extra account with administrator rights is a standing key, and the creation record is the only thing that shows who cut it.

Related

• A Remote-Access Program You Did Not Install
• Keeping Evidence Before You Clean Up a Computer
• Who Holds Your Administrator Passwords: Six Places to Look
• What a Compromise Check Can and Cannot Show You

Sources

• Microsoft Support: Manage user accounts in Windows
• Microsoft Learn: Get-LocalUser
• Microsoft Learn: Get-LocalGroupMember
• Microsoft Learn: 4720(S) A user account was created