If you do not install BOINC as a service, it shouldn't install those accounts. As far as I know, those are only used for the sandboxing of the client, and that only happens when you install it as a service. When not installed as a service, it's installed under your own user account.

---

Thanks for replying.

I up-graded from the previous version to current (v 7.10.2) before posting. From memory, I didn't see an option to un- / select BOINC as a Service, and only noticed the accounts later in Windows Accounts.

Will I loose my 'Work Done' if I un-install, and re-install v 7? Or, is there another option to remove the 2 accounts? I don't see any options in the BOINC Manager.

The option to install not as a service is in the installer, third screen in, click Advanced, on the next screen uncheck "Service Install".



You can uninstall BOINC and reinstall it without losing work in progress, as long as the project has checkpointing applications.
Unfortunately, the BOINC uninstaller does not clean up after itself, so it won't delete the accounts it made. You will have to do that by hand.

From an elevated command prompt:

net localgroup boinc_admins boinc_master /delete
net localgroup boinc_projects boinc_project /delete
net localgroup boinc_admins /delete
net localgroup boinc_users /delete
net localgroup boinc_projects /delete

That leaves rights to the BOINC data directory showing from accounts with a long hexadecimal numerical name, you can delete those by hand. Or leave them. Best do these between uninstall BOINC and reinstalling it.

---

Before deciding whether to remove the accounts, has there being any reports (successful or not) of those accounts used to exploit, install malware, ransomware etc. on the computer?

Also, how do I confirm the project has check-pointing in place?

Those accounts are limited to use the BOINC programs and data directories and files therein only. They cannot do any of the things you ask. And even if they could, they could do them on the BOINC programs and data directories and files therein only. So not really interesting for potential attackers.

You can check if the project's application checkpoints by setting the checkpoint_debug flag in Event Log Options (CTRL+SHIFT+F) and then checking the event log (CTRL+SHIFT+E)

Thank you for answering my questions and concerns.