Jason you are correct that the account admin accounts retain the SID.
The only true way to mask the admin accounts is to create a completely
new user
account that has the correct elevated privileges for the account. This
gives the account
a unique SID that does not have the identifying information on the
account as an admin
account on the domain. If you look at the SID of an admin account out
of the box you will
see that the last 3 digits in the SID is -500. This designates that the
account is an admin
account. If you look at a user account it will have 4 digits (example
-4553 last digits in SID)
and is not recognized by a hacker as an admin account.
Brian K Davidson, Contractor, Network Security Specialist
Information Systems
Mailto:DavidsonBK.Ctr@bic.usmc.mil
-----Original Message-----
From: Beauford, Jason [mailto:jbeauford@EightInOnePet.com]
Sent: Tuesday, November 15, 2005 5:35 PM
To: Derick Anderson; focus-ms@securityfocus.com
Subject: RE: Renaming Administrator account
Accounts retain their SID's when you rename them. Renaming the admin
account defeats "dumb" worms/virus/trojans etc, and that's about it.
Determined black hats will know what to look for.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q243330
JMB
| -----Original Message-----
| From: Derick Anderson [mailto:danderson@vikus.com]
| Sent: Tuesday, November 15, 2005 4:21 PM
| To: focus-ms@securityfocus.com
| Subject: Renaming Administrator account
|
| A question for the list, inspired by the server
| hardening/break in
| threads:
|
| Is changing the Administrator account name really
| worthwhile or not? My largely unfounded, sparsely
| researched opinion is this:
|
| So far I haven't read a convincing argument for
| changing the name of the administrator account, and
| there's one reason I've chosen not to - account
| lockout policy. Only the domain Administrator
| account is exempt from lockout unless there's a
| special dispensation for Domain/Enterprise admins I
| don't know about. So choosing another account (and
| thus changing the SID) would take away the
| protection(?) against a DoS attack on the
| Administrator account.
|
| As for providing extra security, I believe it's
| security by obscurity.
| In order to access password-based systems, you have
| a set of public knowledge (username) and private
| knowledge (password): known * unknown = unknown, or
| in a (non)mathematical sense for brute force attacks, 1 * ?
| = ?. Now let's say you change the Administrator
| password, what have you gotten? Unknown * unknown =
| unknown, or ? * ? = ?. You've changed the equation
| but not the outcome. I realize that changing the
| name prevents automated attacks but can't this be
| defeated by not allowing direct remote Administrator
| access? (no VPN account, no OWA account, servers
| locked up in a datacenter...)
|
| Basically what I'm asking is whether changing the
| account name is a fundamental princple or just icing
| on the cake.
|
| Derick Anderson
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
