RE: strange account in Win2k

From: Admiraal, J.E. (CDIV) (J.E.Admiraal@lumc.nl)
Date: 05/28/02 

From: "Admiraal, J.E. (CDIV)" <J.E.Admiraal@lumc.nl>
To: 'Mark Fagan' <Mark.Fagan@esat.com>, incidents@securityfocus.com
Date: Tue, 28 May 2002 19:02:41 +0200

These account ID's are usually domain accounts that are not (yet) identified
by the local machine. It could also be an account that no longer is
recognised by the local machine.

We have the same occurrences here, but waiting for a bit usually clears up
everything to an understandable domain account ("domain\username ")

-----Original Message-----
From: Mark Fagan [mailto:Mark.Fagan@esat.com]
Sent: dinsdag 28 mei 2002 17:30
To: incidents@securityfocus.com
Subject: strange account in Win2k

While setting additional privileges on a Win2k webserver I noticed that
certain privileges (logon as batch job, act as part of o/s, logon locally
and network) were applied to a very strange account -
*S-1-5-21-527237240-162531612-725345543-1008 which is not seen as a user
account. Any ideas folks ?

                Mark Fagan
                TDA
                Esat Business
                1 Grand Canal Quay
                Dublin 2, Ireland.
                E mark.fagan@esat.com
                www.esatbusiness.com

************************************************************************
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the system manager.

http://www.esatbusiness.com

Subscribe to the Esat Business Online Magazine:
http://www.esatbusiness.com/news/subscribe.asp

Subscribe to REALISE - the online magazine from BT Ignite:
http://www.btignite.com/realise

************************************************************************

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Quantcast