NT AUTHORITY\SYSTEM Missing on Domain Controller

[GhostyDog]

Hi

First post here, looks like this place could be a font of all knowledge, or at least a nice place to hang.

Came across the above this morning, when looking at the User Profiles on my DC's I see the following.

DC One

mydomain.com\Administrator

DC Two

mydomain.com\Administrator
NT AUTHORITY\SYSTEM

DC Two is my 'Acting Primary', DC One is for replication and redundancy. Both are fully patched 2K Servers.

If anybody know's how this could have happened and what the knock on effects could be please feel free to join the party.

Thanks

Ghosty

 

[PScottC]

What this suggests is that you have a program or service that uses the SYSTEM account to run on DC2. This is not a big deal. A lot of backup applications use the local account to run for example. Basically, theres a program that has the "Interact with Desktop" functionality enabled.

You may also see some other profiles, like "NETWORK", "NETWORK SERVICE", or "LOCAL SERVICE". These are all built-in security principals that services may run under and generate user profiles. In addition, it may not be a service in the normal sense, it may be a DCOM process that has been setup to run on the system (most notable when you are running IIS)

So don't be alarmed, this is normal. It just suggests that there is more software on DC2 than DC1.

Good Luck!

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[GhostyDog]

PSC,

That's just what I was hoping for a clear, concise and above all friendly answer to my question.

I've never seen this on a DC before, but in this case it's probably exactly as you described as at one point in time (when the company was much smaller) I've been told that the DC was also the Backup Controller.

Thanks for much for setting my mind at ease.

Ghosty