Link to home
Create AccountLog in
Avatar of MilesLogan
MilesLoganFlag for United States of America

asked on

Active Directory Built-in Administrator account

Hi EE

Any idea why I would see the Event IDs below coming from the Built-in Administrator account on mutliple DCs ?

This account is not used and I only the password to it .
events.png
Avatar of Ram Balachandran
Ram Balachandran
Flag of India image

HI,

What is the event you are seeing ? Can you please provide Event ID / description ?

Regards,
Ram
Avatar of MilesLogan

ASKER

Hello .. these are the events .. I also attached them .

EventID      Event Name
528      Successful Logon
538      User Logoff
576      Special privileges assigned to new logon successfully
552      Logon attempt using explicit credentials
537      Logon failure - The logon attempt failed for other reasons
Avatar of Brian Pierce
Have you got any services or scheduled jobs set-up that use it ?
Hi KCTS .. no to the question below .

" Have you got any services or scheduled jobs set-up that use it ?  "
Which user has this logs ? is it from SYSTEM user ?
DCs will not have local user account
This is for the built-in MyDomain\Administrator
Did you perform runas option ?or any application was started with admin privilege?
no action has been taken with that account ..
Is there any map drives created using this user. Also, you can clear the cached password from the  code mentioned in below link

https://www.experts-exchange.com/OS/Microsoft_Operating_Systems/A_448-How-to-DELETE-Windows-Local-Domain-Cached-Credentials.html
No mapped drives , no services , nothing .. No one knows the password so why its so strange that we would see those events coming from that account on some of the DCs.
SOLUTION
Avatar of Ram Balachandran
Ram Balachandran
Flag of India image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
SOLUTION
Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
SOLUTION
Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
ASKER CERTIFIED SOLUTION
Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Thank you all for the great info .. I will work with these ideas and post back .