Computer Account Keeps Creating Local User Account

Question

Computer Account Keeps Creating Local User Account

Jesse 1

Hello

I have had a problem for a while in my network. Several computer accounts keep creating local user accounts and deleting them in a matter of minutes. This occurs in several devices in my environment.

Could this be a service?

1 answer

Your answer

Answer 1

VipulSparsh-MSFT 16,311 Microsoft Employee

@Jesse You can track that activity to find who created the local user account and then check on that particular server/machine to see what kind of processes are running there. they might or might not have the need for that. normally any service account created by any process would not get deleted and should have valid reason for its existence, I would start from this event logs : https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720

Where Account Name [Type = UnicodeString]: the name of the account that requested the “create user account” operation.

-----------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Jesse 1 Reputation point

2021-08-10T15:51:03.787+00:00

Hello @VipulSparsh-MSFT

Thank you for your response.

The new local user account is being created by a computer account (computer-name$), and this account is being deleted within the same minute. The activity has been occurring for over a month now.
VipulSparsh-MSFT 16,311 Reputation points Microsoft Employee

2021-08-11T11:48:08.5+00:00

@Jesse For deeper investigation you can use a process explorer like procmon to see which process on that computer is generating the account and after finding that you can take a decision if that's a valid process. Read more about process monitor here : https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
Jesse 1 Reputation point

2021-08-11T15:03:23.41+00:00

Hello @VipulSparsh-MSFT ,

Thanks again for your response.

So, I carried out an investigation and discovered that before the user account creation and deletion on the hosts, a service (advapi) logged in to the computer using the computer account (computer-account$). But how do I know the particular service using advapi process.
VipulSparsh-MSFT 16,311 Reputation points Microsoft Employee

2021-08-12T04:06:51.117+00:00

@Jesse That's an important operating system dll for windows and can be best answered by Windows folks. Can you tag them on this thread , windows security or windows 10.
Jesse 1 Reputation point

2021-08-12T08:35:07.653+00:00

Thank you @VipulSparsh-MSFT , I have included those tags.
Jesse 1 Reputation point

2021-08-13T07:06:49.937+00:00

Hello @VipulSparsh-MSFT ,

I have included the tags but haven't gotten any response. Is there anything else I should do?

Share via

Computer Account Keeps Creating Local User Account

1 answer

Your answer