User Profile being created without actual login occuring

[carriecpdx]

I have a situation where a user is running a script remotely on several machines. On some of the machines, a profile is actually being created for the person running the script, even though they are not physically logging onto the box.

Has anyone ever seen this? Does anyone now what may cause this?

Thanks in advance!

 

[bcastner]

They are using the Secondary Logon Service.


____________________________
Users Helping Users

 

[carriecpdx]

Doesn't that require the use of the runas command? In the current situation the user was running a vbs script from a normal command line, cscript scriptname.vbs

 

[bcastner]

No.


____________________________
Users Helping Users

 

[bcastner]

I should give you more hints, but I am reluctant to discuss ways to circumvent Windows security.

. You have the secondary logon service that could be exploited by unprotected usernames on remote workstations and servers;

. Similarly, you could run in a SERVICE, NT/AUTHORITY or NETWORK security context. For example, think about ways that the AT and OH commands could be used to schedule a script or event of some kind without requiring a username security context.

. Final hint - Administrative Shares.


____________________________
Users Helping Users

 

[carriecpdx]

Thanks for your input! As it turns out this appears to have something to do with the FastUserSwitching service in XP.

 

[bcastner]

Just a note that Fast User Switching is disabled in Domain settings.


____________________________
Users Helping Users