Solved

Best security practice with Systems created accounts

Posted on 2014-01-08
6
519 Views
Last Modified: 2014-01-12
In the system scan by security officer, they've found a few AD
& local accounts : my colleagues renamed the Window guest
accounts to these accounts & disabled them.  

In UNIX/Linux, we have lp, adm accounts etc which my
colleagues disabled them.

Q1:
Security officer recommends that these accounts be deleted
instead of just being disabled.  What's the best practice?
Delete or just leave them disabled?

Q2:
What are the impacts/implications of removing system
 created accounts?   Can go thru the impact of removing for
 each account (I only know about 'guest' in Windows but I
 see ASPNET account as well;  for UNIX,  there's uucp,
 adm, bin, daemon, ftp, nuucp, lp, tftp)

Q3:
Do people generally rename the Windows local administrator
as a good security practice?  What about renaming UNIX root?
0
Comment
Question by:sunhux
  • 3
  • 2
6 Comments
 
LVL 51

Assisted Solution

by:Netman66
Netman66 earned 183 total points
ID: 39767048
Well, I think you'll find the Guest account - even though it's disabled is needed for generic share permissions behind the scenes.  Not sure you can remove it and if you do, it may impact non-published accounts like the "Everyone" group.

As for renaming the Administrator account, you should do this as best practise and it should be done (correctly) via Group Policy - rename Administrator account so that underlying registry settings get updated too.

As for linux, I'm really not sure you can rename the root account - but, of course, I could be wrong since *nix is not my strength.

The ASPNET account as well as others has extremely limited access (as does Network, Local, etc) and this is by design.  You can check the local Group Policy and see that these accounts don't even have "Allowed to Logon" rights.  They are simply there to run services in the background and nothing else.
0
 

Author Comment

by:sunhux
ID: 39767454
As we're not certain if there's any impact of removing & we don't have
a test/staging environment to test out if removal of guest could have
any impact, is there any  way that we can take a backup (of which files
/folders), then remove them.  After a couple of months, if nobody shouts,
then we can safely say, there's no impact.

Just renaming & disabling guest alone is not a sufficient test that removal
of guest is harmless.

We have a couple of AD accounts too that have been disabled & security
officer insists they should be deleted in case an unscrupulous sysadmin
or someone accidentally enable it back & thus opens up a vulnerability.

Likewise for Linux/UNIX's sys, adm, lp, ... accounts.

Can EE moderator add this thread into UNIX domains as well so that
 *ix  experts can respond on the impact to sys, adm, ...  accounts?
0
 
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 317 total points
ID: 39768344
You can't delete the guest account, nor any of the default accounts (admin and guest) :(
http://technet.microsoft.com/en-us/library/cc755130.aspx
Renaming is fine, however it's security through obscurity, the SID of the accounts does not change, and the SID is often part of the authentication process.
https://support.microsoft.com/kb/243330
http://msdn.microsoft.com/en-us/library/cc230371.aspx
Nonetheless it is a recommended practice, even it's pretty easy to use any account in AD and figure out the administrator account. There are also SID enumeration utilities and methods.
System created accounts can be placed in more restrictive groups to help mitigate their potential abuse.
http://technet.microsoft.com/en-us/library/cc756898%28v=ws.10%29.aspx

For unix it's about the same, you can certainly rename "root" to something else, it's not as easy as windows to figure out who is root. You should disable or remove when possible any accounts not needed. A few weeks or months should be an effective amount of time to tell if the account will be missed or not.
-rich
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 

Author Comment

by:sunhux
ID: 39772929
Hi Richrumble,

http://technet.microsoft.com/en-us/library/cc755130.aspx
I can't find any mention in the above link that Guest can't be deleted;
closest is it recommends to disable it.  The portion most related to
this is extracted below:

You can set rights and permissions for the Guest account just like any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to log on to a domain. The Guest account is disabled by default, and we recommend that it stay disabled.
0
 

Author Comment

by:sunhux
ID: 39772930
Which files & folder(s) can we backup so that we can restore back
a deleted account (AD & local)?
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 317 total points
ID: 39773296
You cannot delete any built-in accounts, see the screen cap attachment.
-rich
guest-delete.JPG
0

Featured Post

Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here are the five steps I suggest to every sysadmin to fix the fall-out from a security breach.
Knowing where your website is hosted is as important as the features you receive, the monthly fee, and the support you receive. Due diligence should be done when choosing your next hosting provider.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question