Unknown Administrator

[lanraider]

Hello All,

After running the MS Baseline Security Analyzer, it flagged me for having more than two administrator accounts. I recognize two, but the third...
This is the account name: S-1-5-21-2190867815-3604470327-847386435-1003. It is not listed in Local Administrators Group or anywhere else that I can find. I'd like to know who this mystery admin is. Anyone have an idea of how I can find out?

 

[linney]

What is your setup? Dual boot, standalone, on a Network?

 

[lanraider]

Sorry. That would help a little, wouldn't it?
XP Home, local network with 2 other PCs, one running W2K and the other another XP Home. Cable modem, Linksys 4port router. All PCs have ZA and Norton. My PC also has TDS-3, which says I am trojan free.

 

[linney]

Has one of the attached PC's been accessing your computer as an Administrator user and left its details in there?

Also when you run TDS-3 is it scanning the other computers drives?

 

[DanMc]

That S-1-5-... number is a SID. A SID is a random number assigned to every user on the system. The fact that you see the SID as a number, and that WinXP can't look up the real name probably means it is an artifact left behind by something. By any chance did you clone the WinXP from another system using ghost or driveimage?

 

[lanraider]

linney and DanMc,

TDS-3 only used for my PC, so far.
A few weeks ago, the other WinXP PC was found to be infested with
Gator, and was restored from the Compaq restore CD. At that time, the
security log from that PC had numerous anonymous logons, some of which
were for my PC.I didn't connect the two events until you two brought up
the remote access questions.
This is great. I think this proves that three heads are better than
one. OK, we pretty much know where it came from, now how do I get rid of it?

 

[linney]

If you want your machines to communicate and access files etc. some permissions (user rights) will be necessary if you are using NTFS.

As this is XP Home to access the Security Tab and thereby user permissions it will have to be done via Safe Mode.

Also I was reading in the TDS-3 forum that if you set TDS to scan "all logical drives" it will actually scan all the drives on your network. You might like to check that out and see if it is so.

This link might be interesting too.

http://groups.google.com/groups?sou...&q="unknown+administrator"+windows+xp+network

 

[lanraider]

Thanks very much for your input, guys.
linney, I'll post back about TDS-3.

Thanks again

lanraider