Hidden Accounts In XP PRO

[Euclid]

Originally posted here by Cybr1d
I think every winxp has them and deleting them is strongly NOT recommended.

The very first thing I do on a new install of XP is delete those accounts. I strongly recomend it.

[alanmott]

Many thanks for your replies people, they've helped greatly. However I am concerned that the use of these two accounts is not only badly documented by M$, but the accounts themselves are hidden. The only detail I've found on M$'s website is a techy doc on technet about the issuing of tickets to allow remote assistance to work - not something the average user will read. As these two accounts are designed specifically for remote access to your machine, they must be susceptible to abuse and hence the user community must be made more aware of them and how to control them.

[Agent_Steal]

Since these accounts seemed to not be very well documented and hidden as alanmott and many of you have suggested. Is there any remote possibility that other MS software may have hidden accounts. Like the Windows 2003 family ?

Just wondering.

[Wazz]

Yes Server 2003 and down will also do this. IUSR_Username is one, Support_388945a0, and I've also seen accounts for .NET. I haven't had any problems after disabling all of these. It really depends on what you do with your system.

[th3>kLuTz]

If you want to disable any acct, including the hidden ones, the best way to work with these accts is to use mmc.

1) go to start --> run and type in "mmc" without the quotes and hit enter
2) go to file --> add remove snap-in or hit cntrl+m and a new window will pop up
3) click on the button that says add and another new window will pop up
4) scroll down through the list until you see "local users and groups"
5) Double click and then another window pops up. Leave the radio button highlighted for local machine and click on Finish
6) Click on Close and then OK...you should be to the console root page then and ready to play with the settings.
NOTE: Be careful what you do as any changes made here overide everything else in the system and may not be reverisble.....
7) double click on the file in the right pane and you will see all the accounts (including hidden ones)
Have Phun and Be safe

[576869746568617]

klutz is right, MMC is best. You can also use "control userpasswords2" using the run command, if you want, but MMC has more functionality. I usually use control userpasswords2 with the runas command under a limited account.

I don't log in as an admin level account unless I absolutely have to. (That way I can more easily distinguish between my usage on admin privelaged accounts and account compromises in my IDS logservers)

Another thing I like to do is rename the default guest and admin accounts, disable the default guest, then set up a user called "Administrator" and one called "Guest". I then give them almost no privelages except log onto the network, and audit the crap out of their use.

Caught several employees trying to gain access to these.

[Cybr1d]

Disabling them is the way to go. There's a reason why those accounts are there and M$ is not a happy camper when people delete certain stuff from their installs . These days people generally will just reformat their PCs and reinstall windows, rather than calling up their troubleshooting hotline .

Below is the link to contact M$ for winXP customer service for basic, home edition help:

http://support.microsoft.com/default...N-US&x=17&y=16

It has listed many manufacturer's of comps to match your needs.

[scriptkiddie18]

I have a question though regarding these hidden accounts
If ther exist and you can dlete them and do many things to them...well how do you create such and account?
i checked out the control "userpassword2" command from MsMittens link on page 1...it might be possible to crate one there?
anyone know?
peace

[576869746568617]

I've been told by a friend that you can do this using control userpasswords2 and then giving the user account "run as service" and "act as part of operating system" rights. I have not verified this though...I really have no need for hidden user accounts, and neither should anyone else. (I think you know what I'm getting at )

[Corso]

hey there guys, it sounds like you figured out why they are there, and how to disable them, but did anyone actually try mailing the M$ tech's and asking them what exactly they are for? haha i dunno was just an idea :P