User Profile on Windows 2003 Server

[Shanthi]

I found some user profiles are being created in our Win2003 server (DC). I am
sure nobody can logon to the server unless the user is administrator or
equivalent. Please detail how this is getting created.


Shanthi

 

[Jon Holvoet]

This is not mush information to go on with, so I can only advise on the
usage of auditing. This might help you determine who actually created the
accounts. Based on your info I can't make an educated guess, but it might be
someone internal, it might be from some applications, or from the outside.

Check your event viewer, and if you can't find anything usefull, enable
auditing.
A good place to get you started would be technet:
http://technet2.microsoft.com/windowsserver/en/technologies/featured/audit/default.mspx

--

Jon Holvoet
MCSA / MCSE Security
Comptia Security+
CISSP


"Shanthi" <Shanthi@discussions.microsoft.com> wrote in message
news:E4BA0C94-3A76-4EFE-8550-16B6142AE045@microsoft.com...
>I found some user profiles are being created in our Win2003 server (DC). I
>am
> sure nobody can logon to the server unless the user is administrator or
> equivalent. Please detail how this is getting created.
>
>
> Shanthi

 

[Roger Abell [MVP]]

Is that server being used as a fileserver also ?
Do the profiles appear partial or complete ?
Partial profiles can come into existance on fileservers such
as if EFS is used on files stored there.

Roger

"Shanthi" <Shanthi@discussions.microsoft.com> wrote in message
news:E4BA0C94-3A76-4EFE-8550-16B6142AE045@microsoft.com...
>I found some user profiles are being created in our Win2003 server (DC). I
>am
> sure nobody can logon to the server unless the user is administrator or
> equivalent. Please detail how this is getting created.
>
>
> Shanthi