OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Account Unknown
From: Brentlinger, Mike (ISS eServices) (mbrentliISS.NET)
Date: Fri Sep 22 2000 - 15:29:50 CDT

In my experiance this occurs when you have granted a user permission and
then deleted the user but not the permission. Though I cant say that Ive
seen this occur within groups.

There could be other issues at hand creating this.

Is there any chance that you have some users in a trusted domain that should
be members of the admin group? You might experiance this if your trust
relationship between the domains was broken after the users were added. Ive
seen "account unknown" appear in those conditions also but I belive that was
related to permissions also.

Can anyone confim / deny my suspiscions?

Mike Brentlinger
ISS Chicago

-----Original Message-----
From: Conor Crowley
To: FOCUS-MSSECURITYFOCUS.COM
Sent: 9/22/00 1:33 PM
Subject: Account Unknown

Has anybody seen a case where a NT Group contains member(s) "account
unknown"? And could this be indicative of a comprimised system? The
reason I ask, is that one particular PDC that was not known for its tight
security, seems to have a lot of these, but only in select groups
(Admins,SysOps).

..Conor