1665 - Unknown machines appear among backup accounts

Modified on Fri, 10 Jul at 4:15 PM

Symptom

Machine backup (ESE) accounts that were never created by an admin appear in a backup estate. The account names are usually in all caps, like the system name of a personal computer. No backups appear for these accounts.


Cause

This likely happens when antivirus software running on a machine finds the ESE installer in the machine's downloads folder and submits the installer for malware analysis. As part of malware analysis, the installer is run in a temporary sandbox environment. This results in a backup account being created for the sandbox. The sandbox now appears as a backup account with an unfamiliar name that was not created by the admin. 

After malware analysis, the sandbox is removed by the antivirus software before any backups are ever made. The account remains visible, but no backups of it exist.


Solution

There is currently no way to prevent this from happening, but you can remove these backup accounts whenever you encounter them. To delete a backup account, follow the steps under "Deleting machine accounts" in Article 1384.

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select at least one of the reasons
CAPTCHA verification is required.

Feedback sent

We appreciate your effort and will try to fix the article