Unrecognized user accounts in Policy editor

[Guest]

Greetings,

Would you be so kind as to enlighten me as to whether I have anything to be
worried about in terms of intrusion into my system? I show the following
Security Settings, and am a bit concerned.

Ctrl Panel - Admin Tools - Local Sec Settings - Local Pol - User Rights Asgn

I am concerned about the following "Settings" which are instantiated for the
"Policy" shown.
Because I don't know enough about either and the appropriate match-up
(correspondence), I have concerns about possible security issues. If they
are directly Federal agency tasked for Patriot Act purposes, then I am not
concerned, but if I am being subjected to other, and defarious assault, then
I need to act to eliminate the intrusions. Bi-Admin indicated that accounts
such as those shown as *S-etc., are rogue accounts, which I eliminaed some
time ago. Those shown below either remained or are new.

Setting(s):
*S-1-5-21-14099082233-746137067-1708537768-1007 ....... 1, 3, 6, 8
*S-1-5-21-14099082233-746137067-1708537768-1008 ....... 2, 3, 8
*S-1-5-21-14099082233-746137067-1708537768-1009 ....... 3, 4, 5, 8
ASPNET
.................................................................................. 1, 3, 6, 8
Brian .................. (that's me)
.................................................. unconcerned
College Users ... (my more trusted users) .........................
unconcerned
Family ................ (untrustworthy users) ............................
unconcerned
SUPPORT_388945a0
............................................................. 7, 8
others which seem appropriate and recognizeable for the Policy/Settings
correspondence.

Policy(ies):
1. Deny logon through teminal svcs.;
2. Logon locally;
3. Access this cmp from network;
4. Replace a process level token;
5. Adjust mem quotas for a process;
6. Logon as a service;
7. Deny Logon locally.
8. Logon as a batch job
others not of particular interest which seem to show acceptable settings.

Thank You.
DrBoneHead

 

[Colin Nash [MVP]]

Greetings,

Would you be so kind as to enlighten me as to whether I have anything to
be
worried about in terms of intrusion into my system? I show the following
Security Settings, and am a bit concerned.

Ctrl Panel - Admin Tools - Local Sec Settings - Local Pol - User Rights
Asgn

I am concerned about the following "Settings" which are instantiated for
the
"Policy" shown.
Because I don't know enough about either and the appropriate match-up
(correspondence), I have concerns about possible security issues. If they
are directly Federal agency tasked for Patriot Act purposes, then I am not
concerned, but if I am being subjected to other, and defarious assault,
then
I need to act to eliminate the intrusions. Bi-Admin indicated that
accounts
such as those shown as *S-etc., are rogue accounts, which I eliminaed some
time ago. Those shown below either remained or are new.

Setting(s):
*S-1-5-21-14099082233-746137067-1708537768-1007 ....... 1, 3, 6, 8
*S-1-5-21-14099082233-746137067-1708537768-1008 ....... 2, 3, 8
*S-1-5-21-14099082233-746137067-1708537768-1009 ....... 3, 4, 5, 8
ASPNET
.................................................................................
1, 3, 6, 8
Brian .................. (that's me)
................................................. unconcerned
College Users ... (my more trusted users) .........................
unconcerned
Family ................ (untrustworthy users) ............................
unconcerned
SUPPORT_388945a0
............................................................ 7, 8
others which seem appropriate and recognizeable for the Policy/Settings
correspondence.

Policy(ies):
1. Deny logon through teminal svcs.;
2. Logon locally;
3. Access this cmp from network;
4. Replace a process level token;
5. Adjust mem quotas for a process;
6. Logon as a service;
7. Deny Logon locally.
8. Logon as a batch job
others not of particular interest which seem to show acceptable settings.

Thank You.
DrBoneHead

The ASPNET and SUPPORT_388945a0 are normal parts of Windows components that
you don't need to worry about. The S-1-5-21... entries are indeed leftovers
from accounts that you have deleted. Even though you deleted the account,
you are still seeing what security policies and rights applied to those
accounts when they existed...