What to do if…
your computer suddenly shows a new local administrator account you did not create

What to do now

1. Isolate the device.
   Turn off Wi-Fi, unplug Ethernet, stop mobile tethering, and disconnect any VPN if you can see it. If it is safe and simple, unplug unknown USB devices.

2. Capture only the basics.
   Take a photo or screenshot of:

   • the login screen showing the new account name
   • any user list you can see without digging
   • any warning, pop-up, or security alert that appeared at the same time
     Write down the exact account name and when you first noticed it.

3. If it is work, school, or IT-managed, stop and escalate.
   Contact your IT helpdesk or security team and say: “A new local administrator account appeared that I didn’t create. I have taken the device offline.” Don’t try to fix it yourself unless they instruct you to.

4. From a different trusted device, secure your key accounts.
   Use your phone or another computer that you trust to:

   • change your primary email password first
   • change banking, finance, and password-manager passwords if you used them on this computer
   • turn on or re-check multi-factor authentication
   • sign out of other sessions where the service gives you that option
     If you reused the same password elsewhere, change it there too.

5. Check whether the account is real only if you can do this safely.
   If you can sign in with a known-good account you already trust, use the computer’s built-in user management screen to check whether:

   • the unknown account exists
   • it has administrator privileges
   • your usual account’s privileges changed
     If you are unsure, skip this and get help.

6. Scan using trusted tools only.
   On Windows, Microsoft Defender Offline can restart the computer and scan outside normal Windows, then you can run a full scan afterwards. On Mac or Linux, use built-in security tools, a reputable security product you already trust, or in-person professional support. Do not download a tool from a pop-up, advert, or unknown support site.

7. Use the safer recovery path if the account looks unauthorised.
   If the account was truly unauthorised, keeps returning, your privileges changed, or a scan finds malware, a safer recovery path is usually:

   • back up only irreplaceable personal files, such as documents and photos
   • avoid backing up programs, installers, scripts, or unknown files
   • wipe or reset the device and reinstall the operating system from trusted sources
   • restore files only after scanning them
     If you are not confident, use reputable in-person support rather than an unknown remote-fix offer.

8. If money was lost or you were scammed, report it and tell your bank.
   Contact your bank or payment provider promptly using a known phone number, app, card number, or official website. In England, Wales, or Northern Ireland, fraud and cybercrime are generally reported through Report Fraud. In Scotland, fraud is generally reported to Police Scotland by phone, online, or in person. If there is immediate danger or a crime is happening now, call 999.