HelpAssisstant_XXXXXX user created and delete events

From: Ron Williams (anonymous_at_discussions.microsoft.com)
Date: 05/21/04


Date: Fri, 21 May 2004 07:18:40 -0700

Hi I have a windows 2003 server with all the security
patches installed,
however i am receiving events in the security log of the
event viewer where a user is created and then deleted.
The new accountname is HelpAssistant_634c49
and the caller username is machinename$
Could this server be compromised or is this a normal
behavior caused by some service in windows 2003?

Regards



Relevant Pages

  • HelpAssisstant_XXXXXX user created and delete events
    ... however i am receiving events in the security log of the ... event viewer where a user is created and then deleted. ... The new accountname is HelpAssistant_634c49 ...
    (microsoft.public.windows.server.security)
  • HelpAssisstant_XXXXXX user created and delete events
    ... however i am receiving events in the security log of the ... event viewer where a user is created and then deleted. ... The new accountname is HelpAssistant_634c49 ...
    (microsoft.public.security)
  • HelpAssisstant_XXXXXX user created and delete events
    ... however i am receiving events in the security log of the ... event viewer where a user is created and then deleted. ... The new accountname is HelpAssistant_634c49 ...
    (microsoft.public.windows.server.general)