Suspicious user account

[sirron]

When I look at my users I see a suspicious user.
It has a (question mark on it with random characters.

Does any one know about this or why its happening?
I don't see it on my test sql server.
any help would be apprecaited

 

[mrdenny]

If you are the only DBA and didn't create it, then it sounds like someone has comprismied your system. What permissions does the account have? Are you running SP3a, filewall (or ACL) infront of the SQL Server, Windows fully patched, got an antivirus installed?

I would delete the account asap, and have netsec block all access from the net to the SQL Server unless it is specifically needed.

Denny

--Anything is possible. All it takes is a little research. (Me)

 

[JoeMiller]

It's also possible that this is a network user name from a network that SQL Server can't connect to. Was this server part of a domain and then disjoined? What you could be seeing is the SID for the user, which are normally numbers preceded by the letter "S", eg. S-12330-12-1-1-123123

HTH

Joe Miller
joe.miller@flotech.net