Local Security Settings, strange entry?

[calamitycj]

Greetings-

I was exploring/tweaking the Local Security Settings/User Right Assignments on my machine and found for the policies "Deny log on locally", "Log on as batch job", and "Deny access from network" that the security settings list "support_388945a0" and "support_3f151ab9".

Can someone tell me what this means?

Thanks!

 

[wolluf]

Presumably somebody wanted to deny users "support_388945a0" and "support_3f151ab9" access to your machine.

Do those users exist on your machine or on your domain, if you're connected to one?

 

[calamitycj]

But we have no users with those names! And, it does not deny them access to my machine, they are named as being the only ones who change/administer those policies. For example, for the policy "Manage audit and security log", the Administrator is listed as the only user able to manage these. With "log on as batch job", and "deny access...", those unknown users named above are listed. My concern is that the server is pushing out policy settings to our machines; we have had a suspected security breach.

Any insights?

 

[wolluf]

Well if someone has set global policies for the domain that would explain it - as they override local ones.

Have you tried posting on the 2k server forum (I've limited experience of 2k server administration), someone there may have more idea of what's going on with your settings.