Re: Process running under Adminstrator account

Ryan <Ryan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
I disabled the administrator account for security reasons. At the
same time the event log shows failed administrator logon attempts.
Attempts repeat every 2 till 5 hours. The calling process has PID 944
which I looked up as svchost process.
This refers to the following services:

svchost.exe 944 AeLookupSvc, AppMgmt, BITS, Browser,
CryptSvc, dmserver, EventSystem,
helpsvc,

lanmanserver, lanmanworkstation,
Netman,

Nla, RasMan, RemoteAccess, Schedule,

seclogon, SENS, ShellHWDetection,
winmgmt,
wuauserv

I can not find any service that starts with Administrator account.
Does someone have any suggestions?

As Susan said, you need to re-enable it.

I don't bother to rename the admin account anymore, either. Security by
obscurity = pretty useless, as anyone trying to hack into your server is
going after the well-known SID anyway.


.

Loading