Strange system account behaviour

[Uroboros]

Is it normal for win2k pro to periodically create a folder in
"Documents and Settings" named after the hostname with a dollar sign
appended (MYWIN2K$, for example)?

This folder seems to be owned by the system account (S-1-5-18), and an
S-1-5-18 key is created in the registry at
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Profilelist

If I delete this key and the folder in Documents and Settings, there
seems to be no ill affects, but both will return after a few hours.

There seems to be no predictable circumstances in which the profile
will be recreated.

Am I right in assuming that this behavious is odd? Every other win2k
system I've looked at doesn't do this.

I don't have any other problems with this particular installation. I'
just kind of curious as to why this is happening.

 

[Jerold Schulman]

Is it normal for win2k pro to periodically create a folder in
"Documents and Settings" named after the hostname with a dollar sign
appended (MYWIN2K$, for example)?

This folder seems to be owned by the system account (S-1-5-18), and an
S-1-5-18 key is created in the registry at
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Profilelist

If I delete this key and the folder in Documents and Settings, there
seems to be no ill affects, but both will return after a few hours.

There seems to be no predictable circumstances in which the profile
will be recreated.

Am I right in assuming that this behavious is odd? Every other win2k
system I've looked at doesn't do this.

I don't have any other problems with this particular installation. I'
just kind of curious as to why this is happening.

Yes, this is odd behavior.

MYWIN2K$ is the correct SAM account for the computer, but it should be creating
a profile. It appears that some process thinks it is a user.



Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com