General discussion

Locked

finding hidden users

By taffwatts ·
How would I go about finding possible hidden user accounts within NT? I have some audited event log entries which list a password change for "username$". I know that adding the $ to the end of a folder hides it from view, does the same apply to usernames? When legitimate users change their password, their username appears as is (ie without the $ sign). There is no entry in the User Manager for Domains for "username$", and I am concerned that network security may have been compromised.

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

finding hidden users

by RSP In reply to finding hidden users

The username$ accounts that you see are machine-accounts, not users. Each machine has an account with the domain to identify it. It's nothing to worry about. You'll often see password changes on computername$ accounts. As far as I'm aware, there is no way to hide a username.

If you've got machines named after users eg Fred uses machine name Fred, you'll see password changes for Fred$, which is possibly where you're getting confused.

Hope this helps

Richard

Collapse -

finding hidden users

by taffwatts In reply to finding hidden users

You are quite correct. Many Thanks.

Collapse -

finding hidden users

by taffwatts In reply to finding hidden users

This question was closed by the author

Back to Windows Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums