Changing user account names

[12:01] <@JP> [05:48] <JP> I changed the username of that account, via the user control pannel
[12:01] <@JP> [05:48] <JP> now, everything works fine
[12:01] <@JP> [05:48] <twide> ok
[12:01] <@JP> [05:48] <JP> however, when the box is locked
[12:01] <@JP> [05:48] <JP> IE, screensaver password, or whatever
[12:01] <@JP> [05:48] <JP> it comes up with the user/pass dialog
[12:01] <@JP> [05:49] <JP> but under user, it has the old username auto-filled in
[12:01] <@JP> [05:49] <JP> instead of the new one
[12:01] <@JP> [05:49] <JP> now, I can change it manually each time, and log in just fine
[12:01] <@JP> [05:49] <JP> however, it's annoying to have to change it each time, and would rather have it default to the current username

Indeed, it would be better if it'd automatically change the username.
After reading this, I did some testing on my own. JP was on XP, I'm on 2k. Here's what I tried:

I have two accounts on my box:

Administrator with full admin priviliges.
Negative with limited priviliges.

I changed Administrator to Test via the user control panel, keeping the same password.
If I ctrl-alt-del, it still tells me I'm logged in as Administrator. Same problem as JP...
Now, if my screen-saver pass-word-box pops up, it also says I'm still logged in as Administrator.
I can "log in" both as Administrator AND as Test... NOT normal, if you ask me...

Even if I "log in" as Test, ctrl-alt-del-ing still says I'm logged in as Administrator.

Now something weird: if I access the user control panel, there's just the Negative-account: NO Test, NO Administrator...
I log out as Administrator and try logging in again as Administrator: no luck... Only Test works (as should).

Anyone else ever experienced this? Or willing to try it?

really wierd and stupaid as well. i was like ... wtf is going on
i just tried it .. exactly as u mentioned.

but i don't think there's anything wrong ... it's a MS bug, as we used to it .

i'm running XP Pro.
test # 1:
i rename my admin user name from X to Y.
try " switch users " , u'll get the old username " X " in the loggin on box
and by the way, the password works fine , as if the account user name still X.
try "Y" as well , it also works .

test #2:
do the same but this time with a system reboot.
logging box appear with old user name "X" and the password works for that to.
the new user name also works.

test # 3:
negative try to ( ctrl+alt+del) and lock the computer
u'll see what it says.
this computer is in use and has been locked
only ( computer name\old user name\ ( new user name ) can unlock

now if u check the computer management for users and groups.
u'll find the following.
the new user name dosn't act 100% as a new user
but all it do is changing the full name of the old admin user name !!
thats why, both the old and the new user names works with the same password.

but not changing the userneame while logof it's something very wierd.

do MS have a forum with " Ooops ... it's a bug ! " as AO , LOL, i don't think they'd even think about it, u know why ! ;)

but if u go to computer management > system tools > Event viewer > security
that would be on XP Pro,
u'll find that it would give u an faliure audit for an unauthorized user name or passwordstrying to log on.

well, i think u can contact ms for clarifications on the following url:
http://go.microsoft.com/fwlink/events.asp.

note, this works only for admin accounts :) if u tried to paly it with the guest account or any limited priviliges account , it won't work.

enjoy the discovery channel with Microsoft where would u like to go today ;)

ciao'

edit:

sorry , but i've noticed one thing.

changing the user name doesn't change the account name.
we two names
User name
account name
and what u r really trying to change is the user name .
but the account name remains as it is.

so what u c when u lock the computer by ctrl+alt+del

this computer is in use and been locked
only [ computer name\account name\ ( user name )] or any admin can unlock it.

account name can't be chaged if it's an admin account.
u can add or remove unless u r useing the built-in admin account which comes with windows .

There is no way...(that I know) that you can change the Administrator "account name" as for told by bimmer through Control Panel. However if you really want to mess with someone use the Policy editor and set it to allow remote login and then wait and change the password for the admin account on someone :-)

cybermagellan : if u read my post well
i've mentioned that u can't = can not rename the account name but on the other hand u can rename the user name
account name is not equal to user name :)

plus u can add a new user and join it to the admin group, so u'll be haveing two admins.
1- the one u created.
2- the built-in admin which comes standard with win.

cheers bro.

Windows 2000 server(just checked on a 2000 pro machine, there is a security policy option to rename administrator account, the 2000 pro machine is in a domain so, same applies as disclaimer at the bottom, I dont know if that affects the available options or no).

Open Local Security policy module in mmc(may have to apply a local security policy first, I don;'t remember.)

Under..

Security Settings>Local Policies>Security Options

There is a setting called "Rename Administrator Account". What I did(I think, was a long time ago) was right click on that, and check security, then type in the new account name in the field provided.

I do not remember if you then have to apply the policy or not.

The login name and account name should then be changed. Don't forget what you changed it to, as using administrator to log in WILL NOT WORK.

I don't know about XP, but I suspect a similar procedure will work.. I will try it in a minute, as soon as my machine boots up into XP....
<EDIT>
On my XP machine, I do not have the same option in the same place. I do however have a switch to Disable the administrator account. same place as the setting I described before, but is at the very top of the list.

called Accounts: Administrator Account Status.

It is just enabled, or disabled.

So, I suppose you could create a different administrator account, and then disable the main one.

DISCLAIMER----------

My windows 2000 server which I checked this out on is not part of a domain. I assume joining to a domain does not change the options available under local security policy.

My Windows XP machine is part of a Windows 2000 Active Directory domain, I do not know if that made any changes to the options available in local security policy.

You can change the local administrator account name in XP Pro or 2000 through the local security policy regardless of whether or not you are connected to a domain.

There are two explicit administrator accounts in a domain. There is a domain administrator which is pointed to by "mydomain\administrator" and a local administrator pointed to by "mycomputer\administrator". The two accounts are quite different and have different SID's, (Security Identifiers). A local administrator has all the rights in the world on the local machine but try to admin a machine across the network with that account..... Won't work. OTOH, if you join the computer to the domain and log in as the domain administrator you can do anything you like to any machine since the domain administrators security group has been added to the local administrators group of the local machine.... Now relogin as the local administrator and try again to admin a machine across the network.... Still won't work.... Magic HUH? :D

Furthermore, you can change away at the name and the login name of the account and it doesn't change the actual account since you are not changing the SID which is the true account - the name is the friendly name since the users wouldn't want to type a 30 odd digit number every time they logged in......

Quote:

---

Originally posted here by Negative
[12:01] <@JP> [05:48] <JP> I changed the username of that account, via the user control pannel
[12:01] <@JP> [05:48] <JP> now, everything works fine
[12:01] <@JP> [05:48] <twide> ok
[12:01] <@JP> [05:48] <JP> however, when the box is locked
[12:01] <@JP> [05:48] <JP> IE, screensaver password, or whatever
[12:01] <@JP> [05:48] <JP> it comes up with the user/pass dialog
[12:01] <@JP> [05:49] <JP> but under user, it has the old username auto-filled in
[12:01] <@JP> [05:49] <JP> instead of the new one
[12:01] <@JP> [05:49] <JP> now, I can change it manually each time, and log in just fine
[12:01] <@JP> [05:49] <JP> however, it's annoying to have to change it each time, and would rather have it default to the current username

Indeed, it would be better if it'd automatically change the username.
After reading this, I did some testing on my own. JP was on XP, I'm on 2k. Here's what I tried:

I have two accounts on my box:

Administrator with full admin priviliges.
Negative with limited priviliges.

I changed Administrator to Test via the user control panel, keeping the same password.
If I ctrl-alt-del, it still tells me I'm logged in as Administrator. Same problem as JP...
Now, if my screen-saver pass-word-box pops up, it also says I'm still logged in as Administrator.
I can "log in" both as Administrator AND as Test... NOT normal, if you ask me...

Even if I "log in" as Test, ctrl-alt-del-ing still says I'm logged in as Administrator.

Now something weird: if I access the user control panel, there's just the Negative-account: NO Test, NO Administrator...
I log out as Administrator and try logging in again as Administrator: no luck... Only Test works (as should).

Anyone else ever experienced this? Or willing to try it?

---

So, you changed the admin name, then you could log in with both names while the admin account was logged in. After you logged out with the admin account, you can only log in with the new name... right?
So what's the point ? What do you want to say ? It doesn't really bring real security risks to the useraccount things of windows who didn't alreadu exist... It's just right after you changed it's a bit weird, both accounts work and then after a "restart" it works fine... Looks just like the way windows works to me. Just have to reboot for everything.
Did I get this all wrong ? or what's the problem ?
Just let the Administrator account keep it's name. If you want to change the name for "security" reasons... well... it isn't hard to find out the new name and your only CREATING unnesecery risks.
Anyways, I tried it to. It didn't work for me. I tested it on windows xp home, wich was a bit tweaked by me some while ago, but without that in it's installation-state.

Creating risks by renaming the administrator account? I beg to differ. On a standard install of any windows( NT, 2000, XP) machine there is always one account which has all the rights. Administrator. If someone wants to log into your machine(remotely) with full rights, all they need to do is figure out the password for administrator. If you choose a good password, that should not really be a problem, but it is even better if you also change the user name, because, someone cannot brute force the administrator account password if they do not know the login name of the administrator account. You can try trillions of billions of different passwords with the username Administrator, and not get in, if the administrator account has been renamed ****ing-administrator.

As for being easy to find out what the name is? bullshit. If you do not have local access to an already logged in machine, you can't find out what the name is(if the machine is properly patched, and otherwise secured, and if a decent firewall prevents access to all the ports etc.). I would put out a machine for which the Administrative username cannot be discovered without local access, unless it is compromised a different way. Which it would not be if it is patched and secured with a good password for a different admin name, and only has limited ports available on teh internet. Of course there is always the worry about zero day exploits, but, those people that havesuch a thing will get in regardless.

:eek: What did I start? ;)

Quote:

---

Originally posted by neel
It's just right after you changed it's a bit weird, both accounts work and then after a "restart" it works fine... Looks just like the way windows works to me. Just have to reboot for everything.
Did I get this all wrong ? or what's the problem ?

---

No problem... just annoying ;)

But what about the disappearing Admin-account?

Quote:

---

Now something weird: if I access the user control panel, there's just the Negative-account: NO Test, NO Administrator...

---

After a reboot it's all fine again, true that... but it's still not how it's supposed to be.. I think... maybe... :/

I don't use the user and passwords applet in control panel to manage my local accounts. Instead use the local users and groups MMC.

There are several ways to get to it. One is by right clickin on computer management and then open the Local users and groups section.

Or you can use the Users and Passwords applets, and then select the advanced tab, and click the advanced button halfway down the screen. It doesn't appear to have the problems you are describing above.. you can also change the admin account name(or any account name) through the MMC without needing to use a policy.

and as a side note- you can always change the account name and the full name. The only thing you cannot change is the SSID.

I know this an "old" post... but I wanted to add something...

FOR WIN2K/XP
I ALWAYS rename the admin account. Goto admin tools via control panel, computer management, etc. user accounts. Right click on account and rename it to something else.

THEN...

I create another user account with no privledges... I call that one administrator. Disable this account and audit it.
The first user id someone goes for is the admin account.

Tell tale signs someone is trying to gain admin access. Only a few certain people (who you tell) will know what has actually happened and which account to use.

BEWARE: If you do this with a XP box... and you need to use the recovery console... you will not be able to access it with the XP disk. It asks for the adminstrator account and password... but it no longer is exists. It is called something else now.

The way to get around that is to use a Win2k disk and boot to recovery console. The Win2k disk doesn't ask for admin user id and password to login into recovery.

thats an old thread - i was linked from :
http://www.antionline.com/showthread...hreadid=250432

however..
it's really heavy that windows allows any admin to change any admin....
but it's very interesting thing to see what happens if you do from the account itself
you are changing the name but you stay logged in with the old name....

what happens when deleting the Administrator from the Administrators group
after adding him to the users group?

?? ;D