How to delete builtin user account from active directory
I have some users accounts that are disabled and not sure who created them but we need to delete them from AD for the auditors. Is there a way to delete these from AD. The server is 2008 R2
These accounts are have like bogus names to them not like administrator or anything like that..
These accounts are have like bogus names to them not like administrator or anything like that..
Larry Struckmeyer MVP
Please give one or more examples of the "like bogus names". And what is the auditors objections to "built in accounts"?
ASKER
it test
krbtgt
No clue what they were ever used for..
krbtgt
No clue what they were ever used for..
ASKER
Also the accounts are listed under the disabled accounts
Those would not appear to be built in accounts. If disabled, and you have a system state backup I believe they can be removed. Disabled accounts have no use and would only be reactivated if the users returned to duty.
Maybe check their group memberships and see if you can trace down what they might have been used for.
Maybe check their group memberships and see if you can trace down what they might have been used for.
ASKER
When I try to delete them it keeps telling me that builtin accounts cannot be deleted. Even tired via adsiedit but no go..
Built in accounts do not have such names. System or Administrator are built in accounts.
ASKER
I know that that's why I don't understand why it is saying I can delete them because they are built in accounts
Can you move them?
ASKER
yes it lets me move them....
Do not delete krbtgt, http://windowsitpro.com/security/q-what-krbtgt-account-used-active-directory-ad-environment
I think the account is disabled by default. Just need to worry about it test.
I think the account is disabled by default. Just need to worry about it test.
ASKER
Awesome find thanks..
Just need to figure out how to delete the it test account...
Just need to figure out how to delete the it test account...
Does the IT Test account have any additional information with it like description or user logon name? I have found that you can rename a builtin account.
ASKER
No it does not have any description with it but for the login in it says it@xxxxxxxx
where the x'x are is their domain name...
where the x'x are is their domain name...
Are you able to go into the properties of the account, go to security, add yourself and give yourself full control, then delete.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
You got it right again...
It has the beginning sid number for the administrator account so that is why I can delete it. I guess some one renamed it to it test at some point..
Thanks for all your info..
It has the beginning sid number for the administrator account so that is why I can delete it. I guess some one renamed it to it test at some point..
Thanks for all your info..
ASKER
I've requested that this question be closed as follows:
Accepted answer: 0 points for vmich's comment #a40368390
for the following reason:
account was an administrator account before found via sid...
Accepted answer: 0 points for vmich's comment #a40368390
for the following reason:
account was an administrator account before found via sid...
ASKER
Sorry I clicked on my own instead of yours Clifton for the solution...
How do I change that?
How do I change that?
Object, Author states clicked on wrong comment to accept as solution.
ASKER
Yes I just sent the moderator the same so that I can resolve this..
Sorry for my screw up
Sorry for my screw up
No problem, it happens.
ASKER
account was an administrator account before found via sid...