Suspicious temporary user account in Windows - tvsu_tmp

Question

I discovered a new user account on my computer and took this photo immediately. After a few seconds when returning to the start screen the account was gone.

What is the background to this?

Solution

It's related to Lenovo ThinkVantage System Update - TVSU

ThinkVantage System Update™ helps you reduce the time, effort, and expense required to support and maintain the latest drivers, BIOS, and other applications for Think or Lenovo systems. It enables you to get the latest updates from the Lenovo support site.

A design point of TVSU is that even limited users can install updates from Lenovo. And to accomplish this, the TVSU service creates a temporary admin account with a random name and random password, and uses it to do the installations on behalf of the limited user. This is the only time the account is created. The account is not created when an admin user does updates, because the admin user already has the permissions needed to do installations.

The account is supposed to be deleted after the TVSU session finishes, but I'm aware of a case where this doesn't happen and the account stays around. However there isn't any security risk to this because both the account and password are random and not known by anything except the specific TVSU process that created them, and this process ended the last time TVSU was closed. You can safely ignore the account, delete the account, or else it should be deleted the next time TVSU is run.

Comments

[king_julien]

Ok, thanks. This is a good answer. Can I ask you to link a source for the first paragraph?

[Tetsujin]

Sure - it was Lenovo's own download page - support.lenovo.com/us/en/documents/tvsu-update Will add to answer...