RE: strange account in Win2k

From: Rick Darsey (rdarseyat_private)
Date: Tue May 28 2002 - 10:34:24 PDT

  • Next message: Dan Cuthbert: "Re: strange account in Win2k"

    I have seen this myself. What I have found is that the user will disappear
    after a short time, and I was not able to modify it. I assumed that it was a
    "cache" copy of the user account that I was actually modifying, but I may be
    wrong.
    
    If so, I would be glad to learn what it is.
    
    Rick Darsey
    
    -----Original Message-----
    From: Mark Fagan [mailto:Mark.Faganat_private]
    Sent: Tuesday, May 28, 2002 10:30 AM
    To: incidentsat_private
    Subject: strange account in Win2k
    
    
    While setting additional privileges on a Win2k webserver  I noticed that
    certain privileges (logon as batch job, act as part of o/s, logon locally
    and network) were applied to a very strange account -
    *S-1-5-21-527237240-162531612-725345543-1008 which is not seen as a user
    account. Any ideas folks ?
    
    		Mark Fagan
    		TDA
    		Esat Business
    		1 Grand Canal Quay
    		Dublin 2, Ireland.
    		E mark.faganat_private
    		www.esatbusiness.com
    
    
    
    
    
    ************************************************************************
    This email and any files transmitted with it are confidential and intended
    solely for the use of the individual or entity to whom they are addressed.
    If you have received this email in error please notify the system manager.
    
    http://www.esatbusiness.com
    
    Subscribe to the Esat Business Online Magazine:
    http://www.esatbusiness.com/news/subscribe.asp
    
    Subscribe to REALISE - the online magazine from BT Ignite:
    http://www.btignite.com/realise
    
    ************************************************************************
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com
    
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue May 28 2002 - 11:52:22 PDT