Re: Administrator account renamed

From: Steve Clark [MSFT] (bogus_at_microsoft.com)
Date: 11/04/04 

Date: Thu, 4 Nov 2004 13:30:40 -0800

Why is that?

You remember where this came from? Yep, NT 4.0 and the "redbutton" attack.

While many say this is "best practice", I submit it's next to worthless
since "Administrator" account uses one of several "well known SID's". It
doesn't change attack surface at all: it only obscures the target from the
(idiotic) attacker. An intelligent attacker will know what SID to look for
anyway.

So, I'm not saying "give up, all is lost" I'm saying "Maybe your efforts
would be better spent on tasks other than renaming accounts for the sake of
security"....

"WayuU" <WayuU@discussions.microsoft.com> wrote in message
news:E1FB2C3A-7C39-4138-B5AC-04CB504AA9A7@microsoft.com...
> If you have an account with full administrative rights, then you should
> NEVER
> let that account be named "administrator". So it's a good thing your
> account
> got renamed by "accident" by you.
> If you've deleted an account, you can never reinstate it (even though u
> name
> it exactly the same it's still a new one with it's own ID) and get access
> to
> same files.
> So taking ownership is a good solution.
>
> "Colin" wrote:
>
>> I accidently changed the name of my administrator account and have lost
>> access to my administrator documents. When I try to rename the
>> administrator
>> account back to the current name I get a message "Account name
>> 'administrator' already exists".
>> How can I reinstate the original adminidtrator account name ???
>> --
>> Colin