Rouge User Account

[dberg35]

I just found a user account that was created with admin access is there a way to find out who did this and when?

 

[Davetoo]

Security logs should show it.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[dberg35]

Davetoo,
Thanks and I just looked and they do not go back to that time frame.

 

[Davetoo]

I'd change the password on the account and see if anyone is dumb enough to complain. I'd also remove them from the Admin groups...

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[Davetoo]

..I'd also then keep an eye on the account and if it's changed again check the security logs to see who manipulated that account. Check after you change their access rights so you can get the event ID to look for (it escapes me right now).

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[Zelandakh]

Need to kick the person who created the account.

 

[dberg35]

That is the problem isn't I have no idea who created it. At that time the event logs were set to store only a small amount of data then rewrite, I have changed that and forced all to change passwords.

 

[Zelandakh]

I just realised that the thread title is a typo - have been wondering what "Rouge" had to do with your problem...

 

[Davetoo]

Huh? You mean this isn't a cosmetic cover up? ;-)

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[cmeagan656]

...I have changed that and forced all to change passwords.

You should change the password on the rogue user to deny him access. If the rogue user is forced to change it him/herself then all that will show in the security log is that the rogue user changed their password not who the rogue use is.

Also, did you follow Davetoo's other suggestion and remove the rogue user from the admin group?

Cheers.