krbtgt User Account

[Andrew Paiti]

Doesanyone out there know what this account is used for and what the
implications are if the account is disabled?
Ta

 

[David H. Lipman]

If YOU don't know then you are most likely being hacked !

The first thing to do is DISABLE the account, then, go to McAfee
(http://www.mcafee.com/myapps/mfs/default.asp) and/or Trend
(http://housecall.antivirus.com ) and perform an online scan of your platform then report
back your results.

In addition:
If you post to UseNet with your TRUE, not a munged, email address then you have invited the
Swen Internet worm [aka; W32/Gibe-F] to visit you.

Dave



| Doesanyone out there know what this account is used for and what the
| implications are if the account is disabled?
| Ta
|
|

 

[SaltPeter]

Doesanyone out there know what this account is used for and what the
implications are if the account is disabled?
Ta

Its used only by Kerberos. It always looks disabled on a DC from an MMC
console. Since it can't be used to login on a network, don't worry about it.
Audit something else.