Very strange admin account rename issue

  • Thread starter Thread starter WILLIAM
  • Start date Start date
W

WILLIAM

Ok, this is a weird one. I'm at an office where I did not make the master
image, and I had no problems ghosting it to 300+ machines. But now I'm
putting them all out at the desks, and logging in to finish the config when I
noticed this:

I log on locally the first time with the local admin account, call it ABCDE.
When I go to C:\documents and settings I notice I have an ABCDE folder, and
an Administrator folder.

Open gpedit and browse to the Local Security Options and "Rename
administrator account" is set to ABCDE as one would expect. This is always
how we do it. But normally when I rename the admin account, call it LMNOP,
the profile that it uses is still Administrator in Docs and Settings (If I
wanted the profile itself renamed to LMNOP I would have to manually rename
it).

So I ask, how in the heck do I have a profile for the built in local admin
account named ABCDE in docs and settings, AND and profile named Administrator
that doesn't ever get used anymore?

Thanks a bunch....I know it's a bit confusing what I just typed :-)
 
First thing I'd make sure of is that the Administrator foder isn't being
used by some program or other which fails to use the proper method of
accessing userdata, but instead sets absolute-paths to profile contents. If a
program of this kind found its way into the default profile, this would
result in the previous profile-folder re-appearing when the user is renamed.
 
Another strange thing, got an email saying there was a post to this, but I
can't see it :-)

Did some investigating and came up with something, and here's what happened:

When I looked at User Profiles, I saw 2 unknown accounts, one which was
646Mb. I looked in Docs and Settings and "Administrator" was 646 Mb.
Removed the profile, and the Administrator profile magically disappeared!
Well, not really.

Turns out, my guess anyway, the built in local admin account was renamed, as
it should be. Then with another admin account, they renamed the Adminstrator
folder to match the new name. THEN they created a local account and named
it, of all things, Administrator. Logged on, created the profile, dumped
646Mb of junk, logged off, deleted the account, but neglected to delete the
profile. Jeez. This is my life.

A little more investigation and that second unknown account turned out to be
a test user they setup the (incorrect) default user profile (it doesn't have
half what it should). A little more investigation and found it was an image
taken from another site, that has different functions and Windows is set up
completely different for that site.

It was a little time consuming but that HAS to be what happened, I can think
of no other way. Because that Administrator folder deleted when the unknown
account was removed, and as far as I know, if that Administrator folder was
the "built in" admin, there's no way it could have been deleted......whew!
 
just noticed a .consoleone folder in the profile. now i know. they created
a local administrator account, to log into the Tree with the administrator
account! Can you believe that???
 
Back
Top