What to do if…
your computer suddenly shows a new local administrator account you did not create

What to do now

1. Disconnect the computer from the network.
   Turn off Wi-Fi, unplug Ethernet, and disconnect from any VPN. If an unknown USB drive, security key, or external device is plugged in and it is safe to remove, unplug it. Do not reconnect the computer to see what happens.

2. Record the basics before changing anything else.
   Take a photo of the login screen or user list showing the new account. Write down:

   • the exact account name
   • when you first noticed it
   • whether your usual account still appears
   • whether your usual account still has administrator rights
   • any recent remote-support session, repair visit, new software, update, or shared-device use

3. If this is a work, school, or managed device, stop and escalate.
   Contact the IT, helpdesk, or security team from another device and say: “A new local administrator account appeared that I did not create. I have taken the device offline.” Do not try to remove the account unless they tell you to.

4. From a different trusted device, secure the accounts that could unlock everything else.
   Use your phone or another computer you trust, not the affected computer. Start with:

   • your primary email account
   • bank, credit card, payment, and investment accounts
   • work or school accounts
   • cloud storage and password-manager accounts
     Change passwords to unique new passwords, turn on or re-check multifactor authentication where available, and sign out of other sessions or devices where the service offers that option.

5. Check whether there is an obvious non-criminal explanation, without taking risks.
   Think about whether a repair shop, family member, IT tool, school/work management profile, remote-support program, or operating-system setup could have created the account. If you cannot confirm the source quickly, keep treating it as suspicious.

6. Use built-in user management only if you can do it safely.
   If you can sign in with a known-good account you trust, you may check whether the unknown account has administrator privileges and whether your normal account was changed. Do not delete the unknown account yet. If you are not confident, skip this and get help.

7. Scan using trusted tools for your operating system.
   On Windows, run Microsoft Defender Offline if available, then run a full scan after Windows restarts. Microsoft Safety Scanner can be used as an additional Microsoft scan tool. On a Mac, keep the device offline and use Apple’s built-in security protections and software update route; if you are unsure, contact Apple Support or a reputable local technician. On Linux, get help from someone you trust before editing sudo, root, or user files.

8. If the account was truly unauthorized, plan for a clean recovery.
   If the account keeps returning, scans find malware, files are encrypted, or you cannot explain how the account appeared, the safer recovery path is often to back up only irreplaceable personal files, wipe or reset the computer, reinstall the operating system from trusted sources, and restore files cautiously after scanning them.

9. If money, identity theft, extortion, or ransomware is involved, report and contact affected services.
   Contact your bank or card issuer promptly if financial accounts may have been used. For cybercrime or ransomware in the U.S., you can file a report with the FBI Internet Crime Complaint Center. If this is an organization, follow the incident-response process and consider CISA ransomware guidance.