Windows Forum

Ask something
Discussion Locked

Hidden User$

0 helpful
9 replies

by ttoe

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We have a windows 2000 domain and several remote sites. At one of our sites, I noticed a user account with permissions named domain\username$. Now, when there's a share called \\server\data$, that indicates a hidden share. Is there such a thing as a hidden user? I'm the admin, and I don't see any user by that name in AD users and computers, so I can't delete the name. Normally, after I delete a user, the SID shows up, or it says account unknown, but that's not the case here. It seems as if it's correctly resolving the user. The reason I'm concerned is that the user's name is the name of a former admin that was let go. Without scouring each file, directory, and object, how can I be sure my network is safe?

9 replies

by dmiles

The system automatically creates hidden "administrative shares" for its logical drives C:, D:, and so forth which it names C$, D$ and so forth. It also creates the admin$ hidden share for to the \winnt folder. These shares are designed for remote access support by domain administrators. By default, if you delete these admin shares, they will be recreated when you reboot. To disable permanently so they will not be recreated on the next reboot, use the following Windows NT / Windows 2000 / Windows XP registry hack:
Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareServer for servers
Name: AutoShareWks for workstations
Type: REG_DWORD
Value: 0

by ttoe

This is not an administrative share, just a directory permission. I'm familiar with administrative/hidden shares, I'm just confused about the USER account with the $ at the end. Thanks for the reply, though.

by joseph moore

First off, I take it you deleted the user account the old admin had, right? Let's assume so.

Now, I have never heard of or seen a hidden user like you are seeing. What you might be seeing is the hidden machine account that is made when each machine joins the domain. Technicall, a new domain machine member has 2 records written in the NT SAM and in AD for Win2K. One record is just the machinename (MACHINE1), and the other is a hidden machine name (MACHINE1$) that you will NOT see in Server Manager or AD Users & Computers. But it exists!

So, is there a workstation that has the same machinename as the old admin's username? That might be what you are seeing.

hope this helps

by ttoe

Thanks for the reply. This is very close, but not quite enough for me to feel confident enough to put this issue to rest. There is a computer with that username, and I tried assigning rights to my computer's account with a $ at the end and it worked. However, when I did this, I noticed the icon on the left was the 'computer' icon, and the user$ in question had the 'person' icon, which leads me to believe that this is a user account.
Is there a way I could look at the SID and determine anything from that? Or could it be possible that the admin had created a workgroup with the same name and assigned his rights from there?
Unfortunately, I have to reject the answer in order to reply to it, but I think we're on the right track here.

by dbowlin

See if you can get at it with one of the command line utilities like secedit.exe. At the very least you should be able to strip all rights and permissions from this account this way.

Good luck,

by ttoe

Do you have any tips on how to use this? I looked into it, and it seems i need to specify a /db parameter. Since I don't have a /db, i need a /cfg. Where can I get the templates that the help file is referring to?

by sativocomputerservices

on your domain controller run "adsiedit.msc" from the run line. Under you DC=domainname,DC=com expand that to browse for this user(Not knowing where the userresides you may have to expand through your container tree). The user will have a folder called CN=username$ when you find it. All you need to do is delete this folder and the user object will be deleted. I have encountered this problem on a support call to a local business. They had much the same problem with a previous admin. Getting rid of the user is the ONLY sure fire way to make sure that the user cannot login.

by ttoe

I checked through all the accounts in there, and the only one in there with that name was the computer he used with the same name. It's been deleted, and I no longer see permissions for this user. Whether or not it was the computer account, the rights are gone, so I feel much better about it.

This discussion is closed to new replies.