Hidden Accounts In XP PRO

Hi all,

I've just installed Windows XP Professional on my laptop. At the command prompt, if I type in the NET USERS command XP reports the existance of two accounts that are not of my making. They are "HelpAssistant" and "SUPPORT_388945a0". I guess that they are service accounts created by Windows for automatic update and the like, although they seem to be undocumented. Also, the "User Accounts" applet in control panel does not report these accounts. Does anyone actually know what these accounts do? Are can they be exploited in any way?

Regards,

Alan Mott

I don't really know what those two are but i know once you start your computer and you get to the login screen there is a button combination...ctrl+alt+something i dont remember...anyways it lets a window pup-up which lets you sign in as the administrator and some other accounts...this may be related to your topic
peace

/scriptkiddie18

I believe those two accounts are used by M$ when they're helping you out with your computer. I.E. Troubleshooting when u call them with issues. I think every winxp has them and deleting them is strongly NOT recommended. If you notice any new accounts, that could be a sign of intruders. I'm not in my home computer right now but if any of you is, check if you have those accounts too. If not, and you have the same version of xp as alanmott, then he could be infected with a backdoor which would create an account for the attacker to access (I doubt its that though).

cheers,

AlanMott, have you installed any applications like AV software, accounting software, etc?


[edit]

http://www.giac.org/practical/GSEC/D...rader_GSEC.pdf <-- the following link might provide more insight as it refers to how to create hidden accounts in XP. These may in fact be accounts to be used by MS Tech Support and/or other applications (like certain accounting software).

Several new accounts are created as part of the default installation. As these accounts are well known they may represent prime attack targets. To help prevent attacks using the well-known accounts the following accounts should be disabled—HelpAssistant, Guest, Support_388945a0, and Administrator.

***Before disabling the default Administrator account, ensure that another account with administrative privileges exists or the ability to administer the machine will be lost***

I have Norton's Security Suite installed for both AV and Firewall.

My real reason for posting this query is that it appears to be "feature" of XP that I cannot find any reference to on the web, and I think its about time some information about these accounts apeared in the public domain.

Cheers all.

those two accounts are defently a built in part of XP, i`ve just done a fresh install on a machine and they are their.
I do agree though that its a bit funny they are undocumented and do not appear in the user accounts applet.

Quote:

---

think every winxp has them and deleting them is strongly NOT recommended.

---

Yes, this is correct but *disabling* them is recommended. Especially since you may never need to use them.

This link will explain how these accounts are used for remote assistance.
http://www.microsoft.com/windowsxp/p...st/default.asp

--TH13

DeadAddict and thehorse13 are correct....disable them.

Yep, they are M$ default accounts for troubleshooting. "SUPPORT_388945a0" is the account for a M$ support rep and "Help Assistant" is for Remote Assistance. I would do like thehorse and DeadAddict said, except that I would rename the "Administrator" account and equip it with a strong password with strong restrictions (1 incorrect logon attempt, account lockout duration 30 min) rather than disable it.

Even another administrative account doesn't have the power of M$'s default god account. When something bad happens (system compromised or otherwise) and your other admin level accounts can't access resourses the hacker locked down, the default Administrator account will be able to access them, because of the kernel privelages assigned to its SID. If it's disabled and you can't enable it, then your screwed.

Quote:

---

Originally posted here by Cybr1d
I think every winxp has them and deleting them is strongly NOT recommended.

---

The very first thing I do on a new install of XP is delete those accounts. I strongly recomend it.

Many thanks for your replies people, they've helped greatly. However I am concerned that the use of these two accounts is not only badly documented by M$, but the accounts themselves are hidden. The only detail I've found on M$'s website is a techy doc on technet about the issuing of tickets to allow remote assistance to work - not something the average user will read. As these two accounts are designed specifically for remote access to your machine, they must be susceptible to abuse and hence the user community must be made more aware of them and how to control them.

Since these accounts seemed to not be very well documented and hidden as alanmott and many of you have suggested. Is there any remote possibility that other MS software may have hidden accounts. Like the Windows 2003 family ?

Just wondering.

Yes Server 2003 and down will also do this. IUSR_Username is one, Support_388945a0, and I've also seen accounts for .NET. I haven't had any problems after disabling all of these. It really depends on what you do with your system.

If you want to disable any acct, including the hidden ones, the best way to work with these accts is to use mmc.

1) go to start --> run and type in "mmc" without the quotes and hit enter
2) go to file --> add remove snap-in or hit cntrl+m and a new window will pop up
3) click on the button that says add and another new window will pop up
4) scroll down through the list until you see "local users and groups"
5) Double click and then another window pops up. Leave the radio button highlighted for local machine and click on Finish
6) Click on Close and then OK...you should be to the console root page then and ready to play with the settings.
NOTE: Be careful what you do as any changes made here overide everything else in the system and may not be reverisble.....
7) double click on the file in the right pane and you will see all the accounts (including hidden ones)
Have Phun and Be safe

klutz is right, MMC is best. You can also use "control userpasswords2" using the run command, if you want, but MMC has more functionality. I usually use control userpasswords2 with the runas command under a limited account.

I don't log in as an admin level account unless I absolutely have to. (That way I can more easily distinguish between my usage on admin privelaged accounts and account compromises in my IDS logservers)

Another thing I like to do is rename the default guest and admin accounts, disable the default guest, then set up a user called "Administrator" and one called "Guest". I then give them almost no privelages except log onto the network, and audit the crap out of their use.

Caught several employees trying to gain access to these.

Disabling them is the way to go. There's a reason why those accounts are there and M$ is not a happy camper when people delete certain stuff from their installs :). These days people generally will just reformat their PCs and reinstall windows, rather than calling up their troubleshooting hotline :).

Below is the link to contact M$ for winXP customer service for basic, home edition help:

http://support.microsoft.com/default...N-US&x=17&y=16

It has listed many manufacturer's of comps to match your needs.

I have a question though regarding these hidden accounts
If ther exist and you can dlete them and do many things to them...well how do you create such and account?
i checked out the control "userpassword2" command from MsMittens link on page 1...it might be possible to crate one there?
anyone know?
peace

I've been told by a friend that you can do this using control userpasswords2 and then giving the user account "run as service" and "act as part of operating system" rights. I have not verified this though...I really have no need for hidden user accounts, and neither should anyone else. (I think you know what I'm getting at ;) )

hey there guys, it sounds like you figured out why they are there, and how to disable them, but did anyone actually try mailing the M$ tech's and asking them what exactly they are for? haha i dunno was just an idea :P

There are hidden accounts, and you might want to unshare some of your drives also, your C drive is probably being shared and it's hidden by default.

Quote:

---

I really have no need for hidden user accounts, and neither should anyone else. (I think you know what I'm getting at ;)

---

If you know how to do something, you normally know how to undo it as well.. and it can be useful to unmask hidden accounts that employees w/ too high privileges have created..

Anyway, it's a rather simple procedure...
go to start -> run and type regedt32 - or regedit, if you prefer; it doesn't matter..
then open up HKLM\software\microsoft\windows nt\current version\winlogon\specialaccounts\userlist

~to hide an account, create a new DWORD with the name of the DWORD the same as the name of the account you want to hide, and leave the value set to 0.

~to show an account, change the value of the DWORD to 1.

Simple & easy, and the accounts now show on the Welcome Screen and under Control Panel -> User Accounts......

~~Nate

I am running Windows XP Pro and opened the Users and Groups applet. These two accounts do show up in the list of accounts on the system. Does anyone have any ideas why Alan's are not showing up on the accounts list? I am curious why they show up on my list if they do not show up on a fresh install. I did do an updgrade from Windows 2000 rather than do a fresh install. Ideas?

This is an intreresting thread and I did not know these accounts existed?!? So I decided to see what I could do about it. I tried to use MMC but it pops up with a message indicating I cannot access the Locals users and groups option because I am using XP Home. I then tried control userpasswords2 select the advanced tab. There is a section labled acct managment click advanced and the same message. Not available with XP Home. So I tried the registry hack listed above the Help Assistant and several other were already there as DWORD value 0 so I changed it to 1. Reboot I went to the user accts under control panel and even tried control userpasswords2 again. They do not show on the welcome screen either. These accounts still appear to be hidden. Any other suggetions for disabling these accounts in XP Home??
Thanks and Best Regards
Bill

Use the "net users" and "net accounts" commands from the command line.

Type net help user at the command line fot the syntax. The syntax is also available in MS Knowledgebase Article - 251394

As for the "net accounts" command, it is primarily for use with a WinNT/2k/2003 domain, but if net logon is running you can change account policy info (user name, password, lockout policy, etc.)

You can get the syntax by typing net help accounts at the command line or in Microsoft Knowledge Base Article - 194739

Hope this helps

EDIT : Yes geek, it is old-school, but when you system is compromised and the GUI fails to function properly and the only shell that works is cmd, you'll be thankful for the command line, and glad you knoy how to use it. :D

Long live the Command Line, May your black and white archaic syntax forever grace my system.

Thanks for the links! I will look these over. By the way I am new here and this is a pretty good group. I am finding lots of very good info. Thanks again
Bill