Is there anyway to tell who created an nt account?

[Notaro]

An Nt account showed up recently in user manager. We have no idea what its for or who created it. It was in the domain admins group so we were a little worried. We've disabled it and will wait and see if anyone complains. I would like to know where it came from so my question is can this be found out somehow? If not who then maybe when?

Thanks

 

[Kjonnnn]

If i were you... id change the admin password too.

The only way to make an account is on the PDC or BDC. Make sure those are secure.

 

[jaeddy]

Actually, anyonme with admin or account admin permissions can do it from any NT machine with User Manager for Domains installed (i.e. a workstation box with the administrative tools installed, or a member server).

Unless you have security auditing enabled it would be very difficult to figure out who created it. Also, remember that some software packages (Crystal/Seagate Info comes to mind, but there are others) will create accounts for specific functions.

 

[TheLad]

What name is the account? Maybe we can guess if an installation created the account as jaeddy suggested. -----------------------------------------------------
"It's true, its damn true!"
-----------------------------------------------------

 

[Notaro]

HSADMIN