Windows Forum

Ask something
Discussion Locked

finding hidden users

0 helpful
3 replies

by taffwatts

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
How would I go about finding possible hidden user accounts within NT? I have some audited event log entries which list a password change for "username$". I know that adding the $ to the end of a folder hides it from view, does the same apply to usernames? When legitimate users change their password, their username appears as is (ie without the $ sign). There is no entry in the User Manager for Domains for "username$", and I am concerned that network security may have been compromised.

3 replies

by rsp

The username$ accounts that you see are machine-accounts, not users. Each machine has an account with the domain to identify it. It's nothing to worry about. You'll often see password changes on computername$ accounts. As far as I'm aware, there is no way to hide a username.

If you've got machines named after users eg Fred uses machine name Fred, you'll see password changes for Fred$, which is possibly where you're getting confused.

Hope this helps

Richard

This discussion is closed to new replies.