Thanks for your reply. For your issue, I have never found any similar
issues reported so far.
Thanks & Regards,
Ken Zhao
Microsoft Online Support
Microsoft Global Technical Support Center
Get Secure! -
www.microsoft.com/security <
http://www.microsoft.com/security>
====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Thread-Topic: User account goes from Administrators to Debugger Users?
| thread-index: Acg5yS/vJcvNRR9dSTSiG8Tpko0ulw==
| X-WBNR-Posting-Host: 207.46.193.207
| From: =?Utf-8?B?QmFib29u?= <
[email protected]>
| References: <
[email protected]>
<xYm#
[email protected]>
<
[email protected]>
<
[email protected]>
<
[email protected]>
<
[email protected]>
<
[email protected]>
<
[email protected]>
| Subject: RE: User account goes from Administrators to Debugger Users?
| Date: Sat, 8 Dec 2007 10:36:03 -0800
| Lines: 321
| Message-ID: <
[email protected]>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
| Newsgroups: microsoft.public.windowsxp.configuration_manage
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windowsxp.configuration_manage:3317
| NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
| X-Tomcat-NG: microsoft.public.windowsxp.configuration_manage
|
| Thanks.
| We already were auditing Account Management Success and Failure events.
| As I said in my first post:
| "We looked at the Security log and nothing showed up in the Account
| Management category that showed this transaction, going back about 6
months."
|
| I do have some more information that I got from the technician recently.
It
| appears that even though his account showed up in Debugger Users instead
of
| Administrators, he continued to have Administrator rights. So possibly
this
| was just a bug in the UI?
|
| I have not come across this again, so I will not worry about it for now.
| Because I have no data to pass on to you for troubleshooting purposes, I
| don't expect you to be able to find the cause of the problem. Again, I
was
| hoping that if I posted here, I may find that there is a precedent for
this
| problem, but that may not be the case.
|
| Regards.
|
| ""Ken Zhao [MSFT]"" wrote:
|
| > Hi,
| >
| > I am just writing to see how everything is going. If you have any
updates
| > or need any further assistance on this issue, please feel free to let
me
| > know.
| >
| > Thanks & Regards,
| >
| > Ken Zhao
| >
| > Microsoft Online Support
| > Microsoft Global Technical Support Center
| >
| > Get Secure! -
www.microsoft.com/security
<
http://www.microsoft.com/security>
| > ====================================================
| > When responding to posts, please "Reply to Group" via your newsreader
so
| > that others may learn and benefit from your issue.
| > ====================================================
| > This posting is provided "AS IS" with no warranties, and confers no
rights.
| >
| >
| >
| >
| > --------------------
| > | X-Tomcat-ID: 60610963
| > | References: <
[email protected]>
| > <xYm#
[email protected]>
| > <
[email protected]>
| > <
[email protected]>
| > <
[email protected]>
| > <
[email protected]>
| > | MIME-Version: 1.0
| > | Content-Type: text/plain
| > | Content-Transfer-Encoding: 7bit
| > | From: (e-mail address removed) ("Ken Zhao [MSFT]")
| > | Organization: Microsoft
| > | Date: Wed, 05 Dec 2007 06:13:17 GMT
| > | Subject: RE: User account goes from Administrators to Debugger Users?
| > | X-Tomcat-NG: microsoft.public.windowsxp.configuration_manage
| > | Message-ID: <
[email protected]>
| > | Newsgroups: microsoft.public.windowsxp.configuration_manage
| > | Lines: 294
| > | Path: TK2MSFTNGHUB02.phx.gbl
| > | Xref: TK2MSFTNGHUB02.phx.gbl
| > microsoft.public.windowsxp.configuration_manage:3301
| > | NNTP-Posting-Host: tomcatimport2.phx.gbl 10.201.218.182
| > |
| > | Hello,
| > |
| > | Based on your situation, if you have not installed any development
| > | software, I am not sure why the Debugger Users group exists in your
| > system.
| > | We may enable audit event to monitor if there are somebody tries to
| > change
| > | user group. For detailed information about how to configure Audit
Event,
| > | please refer to:
| > | 814595: HOW TO: Audit Active Directory Objects in Windows Server 2003
| > |
http://support.microsoft.com/kb/814595/en-us
| > |
| > | Auditing Security Events Best practices
| > |
| >
http://technet2.microsoft.com/WindowsServer/en/library/5658fae8-985f-48cc-b1
| > | bf-bd47dc2109161033.mspx?mfr=true
| > |
| > | Thanks & Regards,
| > |
| > | Ken Zhao
| > |
| > | Microsoft Online Support
| > | Microsoft Global Technical Support Center
| > |
| > | Get Secure! -
www.microsoft.com/security
| > <
http://www.microsoft.com/security>
| > | ====================================================
| > | When responding to posts, please "Reply to Group" via your newsreader
so
| > | that others may learn and benefit from your issue.
| > | ====================================================
| > | This posting is provided "AS IS" with no warranties, and confers no
| > rights.
| > |
| > |
| > |
| > |
| > |
| > | --------------------
| > | | Thread-Topic: User account goes from Administrators to Debugger
Users?
| > | | thread-index: Acg2h1Mi/rm4C9y/TqqdGM6yS5YVbA==
| > | | X-WBNR-Posting-Host: 207.46.19.168
| > | | From: =?Utf-8?B?QmFib29u?= <
[email protected]>
| > | | References: <
[email protected]>
| > | <xYm#
[email protected]>
| > | <
[email protected]>
| > | <
[email protected]>
| > | <
[email protected]>
| > | | Subject: RE: User account goes from Administrators to Debugger
Users?
| > | | Date: Tue, 4 Dec 2007 07:07:02 -0800
| > | | Lines: 235
| > | | Message-ID: <
[email protected]>
| > | | MIME-Version: 1.0
| > | | Content-Type: text/plain;
| > | | charset="Utf-8"
| > | | Content-Transfer-Encoding: 7bit
| > | | X-Newsreader: Microsoft CDO for Windows 2000
| > | | Content-Class: urn:content-classes:message
| > | | Importance: normal
| > | | Priority: normal
| > | | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
| > | | Newsgroups: microsoft.public.windowsxp.configuration_manage
| > | | Path: TK2MSFTNGHUB02.phx.gbl
| > | | Xref: TK2MSFTNGHUB02.phx.gbl
| > | microsoft.public.windowsxp.configuration_manage:3297
| > | | NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
| > | | X-Tomcat-NG: microsoft.public.windowsxp.configuration_manage
| > | |
| > | | Thanks for checking in.
| > | | Of course we added the apppropriate users back into the
Administrators
| > | group.
| > | |
| > | | Here is the point of my post:
| > | | From what the technician says, nobody actually removed the users
from
| > the
| > | | Adminstrators group or added them to Debugger Users.
| > | |
| > | | I was just hoping that someone might have an explanation for how
this
| > | would
| > | | happen. I was also hoping that someone would have seen this happen
| > | before.
| > | | If nobody has an answer, that's fine. I did my part by trying to
find
| > a
| > | | reason to report back to the people that I am responsible for. If
I
| > can
| > | come
| > | | back and say "Even Microsoft doesn't have an answer for this", then
| > that
| > | is
| > | | usually acceptable.
| > | |
| > | | ""Ken Zhao [MSFT]"" wrote:
| > | |
| > | | > Hi,
| > | | >
| > | | > I am just writing to see how everything is going. If you have any
| > | updates
| > | | > or need any further assistance on this issue, please feel free to
let
| > | me
| > | | > know.
| > | | >
| > | | > Thanks & Regards,
| > | | >
| > | | > Ken Zhao
| > | | >
| > | | > Microsoft Online Support
| > | | > Microsoft Global Technical Support Center
| > | | >
| > | | > Get Secure! -
www.microsoft.com/security
| > | <
http://www.microsoft.com/security>
| > | | > ====================================================
| > | | > When responding to posts, please "Reply to Group" via your
newsreader
| > | so
| > | | > that others may learn and benefit from your issue.
| > | | > ====================================================
| > | | > This posting is provided "AS IS" with no warranties, and confers
no
| > | rights.
| > | | >
| > | | >
| > | | >
| > | | >
| > | | >
| > | | > --------------------
| > | | > | X-Tomcat-ID: 58448270
| > | | > | References:
<
[email protected]>
| > | | > <xYm#
[email protected]>
| > | | > <
[email protected]>
| > | | > | MIME-Version: 1.0
| > | | > | Content-Type: text/plain
| > | | > | Content-Transfer-Encoding: 7bit
| > | | > | From: (e-mail address removed) ("Ken Zhao [MSFT]")
| > | | > | Organization: Microsoft
| > | | > | Date: Fri, 30 Nov 2007 05:45:46 GMT
| > | | > | Subject: RE: User account goes from Administrators to Debugger
| > Users?
| > | | > | X-Tomcat-NG: microsoft.public.windowsxp.configuration_manage
| > | | > | Message-ID: <
[email protected]>
| > | | > | Newsgroups: microsoft.public.windowsxp.configuration_manage
| > | | > | Lines: 144
| > | | > | Path: TK2MSFTNGHUB02.phx.gbl
| > | | > | Xref: TK2MSFTNGHUB02.phx.gbl
| > | | > microsoft.public.windowsxp.configuration_manage:3266
| > | | > | NNTP-Posting-Host: tomcatimport2.phx.gbl 10.201.218.182
| > | | > |
| > | | > | Hello,
| > | | > |
| > | | > | Based on my research, the Debugger Users group will be created
| > after
| > | | > | installing VS. For more related information, please refer to:
| > | | > | Adding Debugger Users and Configuring DCOM
| > | | > |
http://msdn2.microsoft.com/en-us/library/aa291270(VS.71).aspx
| > | | > |
| > | | > | VS2005 and 'Debugger Users' group
| > | | > |
| >
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=133267&SiteID=1
| > | | > |
| > | | > | If the user accounts have been added into Debugger Users group,
I
| > | suggest
| > | | > | you re-add these accounts back to the Administrators group.
| > | | > |
| > | | > | Thanks & Regards,
| > | | > |
| > | | > | Ken Zhao
| > | | > |
| > | | > | Microsoft Online Support
| > | | > | Microsoft Global Technical Support Center
| > | | > |
| > | | > | Get Secure! -
www.microsoft.com/security
| > | | > <
http://www.microsoft.com/security>
| > | | > | ====================================================
| > | | > | When responding to posts, please "Reply to Group" via your
| > newsreader
| > | so
| > | | > | that others may learn and benefit from your issue.
| > | | > | ====================================================
| > | | > | This posting is provided "AS IS" with no warranties, and
confers no
| > | | > rights.
| > | | > |
| > | | > |
| > | | > |
| > | | > |
| > | | > |
| > | | > | --------------------
| > | | > | | Thread-Topic: User account goes from Administrators to
Debugger
| > | Users?
| > | | > | | thread-index: AcgyDe8n4Fw3NKGJTP+xsjevwsN3pQ==
| > | | > | | X-WBNR-Posting-Host: 207.46.19.168
| > | | > | | From: =?Utf-8?B?QmFib29u?= <
[email protected]>
| > | | > | | References:
<
[email protected]>
| > | | > | <xYm#
[email protected]>
| > | | > | | Subject: RE: User account goes from Administrators to
Debugger
| > | Users?
| > | | > | | Date: Wed, 28 Nov 2007 14:28:00 -0800
| > | | > | | Lines: 90
| > | | > | | Message-ID:
<
[email protected]>
| > | | > | | MIME-Version: 1.0
| > | | > | | Content-Type: text/plain;
| > | | > | | charset="Utf-8"
| > | | > | | Content-Transfer-Encoding: 7bit
| > | | > | | X-Newsreader: Microsoft CDO for Windows 2000
| > | | > | | Content-Class: urn:content-classes:message
| > | | > | | Importance: normal
| > | | > | | Priority: normal
| > | | > | | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
| > | | > | | Newsgroups: microsoft.public.windowsxp.configuration_manage
| > | | > | | Path: TK2MSFTNGHUB02.phx.gbl
| > | | > | | Xref: TK2MSFTNGHUB02.phx.gbl
| > | | > | microsoft.public.windowsxp.configuration_manage:3249
| > | | > | | NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
| > | | > | | X-Tomcat-NG: microsoft.public.windowsxp.configuration_manage
| > | | > | |
| > | | > | | Exactly. Neither of these users installed any debug tools,
but
| > | their
| > | | > | | accounts somehow were automatically added to Debugger Users
and
| > | removed
| > | | > | from
| > | | > | | Administrators.
| > | | > | |
| > | | > | | And as I said, there were no entries in the Security Log that
| > | showed
| > | | > | either
| > | | > | | of these transactions.
| > | | > | |
| > | | > | | ""Ken Zhao [MSFT]"" wrote:
| > | | > | |
| > | | > | | > Hello,
| > | | > | | >
| > | | > | | > Thank you for using newsgroup!
| > | | > | | >
| > | | > | | > From your post, I am not sure if you have installed any
debug
| > | tools
| > | | > on
| > | | > | the
| > | | > | | > machine and create the Debugger Users group. By default,
the
| > only
| > | | > | member of
| > | | > | | > the Debugger Users group is the Administrator who installed
the
| > | | > | | > application. Additionally, the Debugger Users group is only
| > | granted
| > | | > | Launch
| > | | > | | > and Access permissions to the Machine Debug Manager. We
| > recommend
| > | | > that
| > | | > | you
| > | | > | | > add the users or the groups that you want to use the Script
| > | Editor
| > | | > | | > component to the Debugger Users group as needed.
| > | | > | | >
| > | | > | | > Thanks & Regards,
| > | | > | | >
| > | | > | | > Ken Zhao
| > | | > | | >
| > | | > | | > Microsoft Online Support
| > | | > | | > Microsoft Global Technical Support Center
|
