Best security practice with Systems created accounts

Posted on 2014-01-08
Medium Priority
Last Modified: 2014-01-12
In the system scan by security officer, they've found a few AD
& local accounts : my colleagues renamed the Window guest
accounts to these accounts & disabled them.  

In UNIX/Linux, we have lp, adm accounts etc which my
colleagues disabled them.

Security officer recommends that these accounts be deleted
instead of just being disabled.  What's the best practice?
Delete or just leave them disabled?

What are the impacts/implications of removing system
 created accounts?   Can go thru the impact of removing for
 each account (I only know about 'guest' in Windows but I
 see ASPNET account as well;  for UNIX,  there's uucp,
 adm, bin, daemon, ftp, nuucp, lp, tftp)

Do people generally rename the Windows local administrator
as a good security practice?  What about renaming UNIX root?
Question by:sunhux
  • 3
  • 2
LVL 51

Assisted Solution

Netman66 earned 732 total points
ID: 39767048
Well, I think you'll find the Guest account - even though it's disabled is needed for generic share permissions behind the scenes.  Not sure you can remove it and if you do, it may impact non-published accounts like the "Everyone" group.

As for renaming the Administrator account, you should do this as best practise and it should be done (correctly) via Group Policy - rename Administrator account so that underlying registry settings get updated too.

As for linux, I'm really not sure you can rename the root account - but, of course, I could be wrong since *nix is not my strength.

The ASPNET account as well as others has extremely limited access (as does Network, Local, etc) and this is by design.  You can check the local Group Policy and see that these accounts don't even have "Allowed to Logon" rights.  They are simply there to run services in the background and nothing else.

Author Comment

ID: 39767454
As we're not certain if there's any impact of removing & we don't have
a test/staging environment to test out if removal of guest could have
any impact, is there any  way that we can take a backup (of which files
/folders), then remove them.  After a couple of months, if nobody shouts,
then we can safely say, there's no impact.

Just renaming & disabling guest alone is not a sufficient test that removal
of guest is harmless.

We have a couple of AD accounts too that have been disabled & security
officer insists they should be deleted in case an unscrupulous sysadmin
or someone accidentally enable it back & thus opens up a vulnerability.

Likewise for Linux/UNIX's sys, adm, lp, ... accounts.

Can EE moderator add this thread into UNIX domains as well so that
 *ix  experts can respond on the impact to sys, adm, ...  accounts?
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 1268 total points
ID: 39768344
You can't delete the guest account, nor any of the default accounts (admin and guest) :(
Renaming is fine, however it's security through obscurity, the SID of the accounts does not change, and the SID is often part of the authentication process.
Nonetheless it is a recommended practice, even it's pretty easy to use any account in AD and figure out the administrator account. There are also SID enumeration utilities and methods.
System created accounts can be placed in more restrictive groups to help mitigate their potential abuse.

For unix it's about the same, you can certainly rename "root" to something else, it's not as easy as windows to figure out who is root. You should disable or remove when possible any accounts not needed. A few weeks or months should be an effective amount of time to tell if the account will be missed or not.
WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!


Author Comment

ID: 39772929
Hi Richrumble,

I can't find any mention in the above link that Guest can't be deleted;
closest is it recommends to disable it.  The portion most related to
this is extracted below:

You can set rights and permissions for the Guest account just like any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to log on to a domain. The Guest account is disabled by default, and we recommend that it stay disabled.

Author Comment

ID: 39772930
Which files & folder(s) can we backup so that we can restore back
a deleted account (AD & local)?
LVL 38

Accepted Solution

Rich Rumble earned 1268 total points
ID: 39773296
You cannot delete any built-in accounts, see the screen cap attachment.

Featured Post

We Need Your Input!

WatchGuard is currently running a beta program for our new macOS Host Sensor for our Threat Detection and Response service. We're looking for more macOS users to help provide insight and feedback to help us make the product even better. Please sign up for our beta program today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Data security in the cloud is very much like a security in an on-premises data center - only without costs for maintaining facilities and computer hardware.
A discussion about Penetration Testing and the Tools used to help achieve this important task.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question