Hi, I have a Hp media center computer m1180n. I just ran a program and it told me i should have a administrator account and maybe a guest account. If anything else, It should be deleted. Well it showed this..
Administrator Yes
ASPNET Yes
Guest No
HelpAssistant No
HP_Administrator yes
I checked user accounts and only see my Administrator account. My Guest account was off.
Why would it say i had a ASPNET and a HP_Administrator account running also? They do not show up in the user accounts. Are thse other accounts normal?
Thanks, Kevin
To Many User Accounts?
-
SherriBabee
- Regular Member
- Posts: 104
- Joined: Mon Jul 25, 2005 9:15 am
- Location: Amboy, IL-USA
Hi Kevin
If you have the .NET Framework installed, the ASPNET is normal; but im not familiar with HP_Administrator.. thats a new one to me. The only users in the Users Account area that show are Administrator(s) and accounts that you personally setup... ASPNET, HelpAssistant, Creater does not show...
Im sure someone else here will reply with more answers than me sweetie...
Rgds
Sherri
If you have the .NET Framework installed, the ASPNET is normal; but im not familiar with HP_Administrator.. thats a new one to me. The only users in the Users Account area that show are Administrator(s) and accounts that you personally setup... ASPNET, HelpAssistant, Creater does not show...
Im sure someone else here will reply with more answers than me sweetie...
Rgds
Sherri
[CENTER]
Toshiba Satellite C655D-S5086,
Win7 Home Prem x64, AMD M785 (RS880M) + SB810/SB850, 8gb Crucial, ATI Mobility Radeon HD 4200 Series,
Crucial MX300, 525 GB, SATA III SSD,
Vizio E552VLE-55 inch TV, Logitech K260 wireless;
Avast HE 7.0.xxxx, Firefox 56.0.2_x32, Windows Firewall, Router[/CENTER]
Toshiba Satellite C655D-S5086,
Win7 Home Prem x64, AMD M785 (RS880M) + SB810/SB850, 8gb Crucial, ATI Mobility Radeon HD 4200 Series,
Crucial MX300, 525 GB, SATA III SSD,
Vizio E552VLE-55 inch TV, Logitech K260 wireless;
Avast HE 7.0.xxxx, Firefox 56.0.2_x32, Windows Firewall, Router[/CENTER]
-
ghettoside
- SG Elite
- Posts: 5134
- Joined: Thu Mar 13, 2003 5:18 pm
- Location: At Large in the US
mandm6 wrote:Hi, I have a Hp media center computer m1180n. I just ran a program and it told me i should have a administrator account and maybe a guest account. If anything else, It should be deleted. Well it showed this..
Administrator Yes
ASPNET Yes
Guest No
HelpAssistant No
HP_Administrator yes
I checked user accounts and only see my Administrator account. My Guest account was off.
Why would it say i had a ASPNET and a HP_Administrator account running also? They do not show up in the user accounts. Are thse other accounts normal?
Thanks, Kevin
Bro, download this from MS and run it.
Post any questionable results. Or if it's all good say so too
HP_Administrator... I assume that it has a pre-installed environment. Some admin account used to setup the box prolly, and you just don't see it listed... but you can log on as such iffen you have the right password. I'm guessing...
Every time I get my hands on a HP, Compaq, Dell or whatever that has a hosed PE OS .. after I recover data, I wipe the mbr and install xp pro lol. I hate pre-installed
I'm sure someone will come along in the morning w/ something more helpful.
btw, I don't believe 2 admin accounts will generate a flag on the MS Baseline Security Analyzer. But I do not like the HP_Admin bit of it. I don't like mystery admin accounts.
Norm wrote:
There are idiots everywhere.
At work, in forums, in poetry classes, everywhere!
[quote="ghettoside"]Bro, download this from MS and run it.
Post any questionable results. Or if it's all good say so too ]
Here is what i came up with after running it... Under Administrators, It has check marks in the score column for both the HPADMIN. and just ADMIN
Computer name: WORKGROUP\ROCKET
IP address: 192.168.1.100
Security report name: WORKGROUP - ROCKET (6-21-2006 2-52 AM)
Scan date: 6/21/2006 2:52 AM
Scanned with MBSA version: 2.0.5029.2
Security update catalog: Windows Server Update Services
Catalog synchronization date:
Security assessment: Incomplete Scan
Security Updates Scan Results
Issue: Security Updates
Score: Unable to scan
Result: Cannot communicate with Windows Update Agent service on target computer.
Operating System Scan Results
Administrative Vulnerabilities
Issue: Local Account Password Test
Score: Check passed
Result: No user accounts have simple passwords.
Detail:
| User | Weak Password | Locked Out | Disabled |
| Guest | - | - | Disabled |
| HelpAssistant | - | - | Disabled |
| SUPPORT_388945a0 | - | - | Disabled |
| SUPPORT_fddfa904 | - | - | Disabled |
| ASPNET | - | - | - |
| Administrator | - | - | - |
| HP_Administrator | - | - | - |
Issue: File System
Score: Check failed (critical)
Result: Not all hard drives are using the NTFS file system.
Detail:
| Drive Letter | File System |
| D: | FAT32 |
| C: | NTFS |
Issue: Password Expiration
Score: Check not performed
Result: This check was skipped because the computer is not joined to a domain.
Issue: Guest Account
Score: Check passed
Result: The Guest account is disabled on this computer.
Issue: Autologon
Score: Check not performed
Result: This check was skipped because the computer is not joined to a domain.
Issue: Restrict Anonymous
Score: Check passed
Result: Computer is properly restricting anonymous access.
Issue: Administrators
Score: Check passed
Result: No more than 2 Administrators were found on this computer.
Detail:
| User |
| Administrator |
| HP_Administrator |
Issue: Windows Firewall
Score: Best practice
Result: Windows Firewall is disabled and has exceptions configured.
Detail:
| Connection Name | Firewall | Exceptions |
| 1394 Connection 3 | Off* | Ports*, Programs*, Services* |
| All Connections | Off | Ports, Programs, Services |
| Local Area Connection 4 | Off* | Ports*, Programs*, Services* |
Issue: Automatic Updates
Score: Check failed (critical)
Result: The Automatic Updates system service is not correctly configured.
Issue: Incomplete Updates
Score: Best practice
Result: No incomplete software update installations were found.
Additional System Information
Issue: Windows Version
Score: Best practice
Result: Computer is running Windows 2000 or greater.
Issue: Auditing
Score: Best practice
Result: This check was skipped because the computer is not joined to a domain.
Issue: Shares
Score: Best practice
Result: 3 share(s) are present on your computer.
Detail:
| Share | Directory | Share ACL | Directory ACL |
| D$ | D:\ | Admin Share | Directory ACL can not be read. |
| ADMIN$ | C:\WINDOWS | Admin Share | BUILTIN\Administrators - F, NT AUTHORITY\SYSTEM - F, BUILTIN\Users - RX |
| C$ | C:\ | Admin Share | BUILTIN\Administrators - F, NT AUTHORITY\SYSTEM - F, BUILTIN\Users - RX, Everyone - RX |
Issue: Services
Score: Best practice
Result: Some potentially unnecessary services are installed.
Detail:
| Service | State |
| Telnet | Stopped |
Internet Information Services (IIS) Scan Results
IIS is not running on this computer.
SQL Server Scan Results
SQL Server and/or MSDE is not installed on this computer.
Desktop Application Scan Results
Administrative Vulnerabilities
Issue: IE Zones
Score: Check passed
Result: Internet Explorer zones have secure settings for all users.
Issue: Macro Security
Score: Check failed (non-critical)
Result: 3 Microsoft Office product(s) are installed. Some issues were found.
Detail:
| Issue | User | Advice |
| Microsoft PowerPoint 2000 | ROCKET\HP_Administrator | Macro security is set to medium, which will allow you to choose whether or not to run potentially unsafe macros. |
| Microsoft Excel 2000 | All Users | No security issues were found. |
| Microsoft Word 2000 | All Users | No security issues were found. |
Post any questionable results. Or if it's all good say so too ]
Here is what i came up with after running it... Under Administrators, It has check marks in the score column for both the HPADMIN. and just ADMIN
Computer name: WORKGROUP\ROCKET
IP address: 192.168.1.100
Security report name: WORKGROUP - ROCKET (6-21-2006 2-52 AM)
Scan date: 6/21/2006 2:52 AM
Scanned with MBSA version: 2.0.5029.2
Security update catalog: Windows Server Update Services
Catalog synchronization date:
Security assessment: Incomplete Scan
Security Updates Scan Results
Issue: Security Updates
Score: Unable to scan
Result: Cannot communicate with Windows Update Agent service on target computer.
Operating System Scan Results
Administrative Vulnerabilities
Issue: Local Account Password Test
Score: Check passed
Result: No user accounts have simple passwords.
Detail:
| User | Weak Password | Locked Out | Disabled |
| Guest | - | - | Disabled |
| HelpAssistant | - | - | Disabled |
| SUPPORT_388945a0 | - | - | Disabled |
| SUPPORT_fddfa904 | - | - | Disabled |
| ASPNET | - | - | - |
| Administrator | - | - | - |
| HP_Administrator | - | - | - |
Issue: File System
Score: Check failed (critical)
Result: Not all hard drives are using the NTFS file system.
Detail:
| Drive Letter | File System |
| D: | FAT32 |
| C: | NTFS |
Issue: Password Expiration
Score: Check not performed
Result: This check was skipped because the computer is not joined to a domain.
Issue: Guest Account
Score: Check passed
Result: The Guest account is disabled on this computer.
Issue: Autologon
Score: Check not performed
Result: This check was skipped because the computer is not joined to a domain.
Issue: Restrict Anonymous
Score: Check passed
Result: Computer is properly restricting anonymous access.
Issue: Administrators
Score: Check passed
Result: No more than 2 Administrators were found on this computer.
Detail:
| User |
| Administrator |
| HP_Administrator |
Issue: Windows Firewall
Score: Best practice
Result: Windows Firewall is disabled and has exceptions configured.
Detail:
| Connection Name | Firewall | Exceptions |
| 1394 Connection 3 | Off* | Ports*, Programs*, Services* |
| All Connections | Off | Ports, Programs, Services |
| Local Area Connection 4 | Off* | Ports*, Programs*, Services* |
Issue: Automatic Updates
Score: Check failed (critical)
Result: The Automatic Updates system service is not correctly configured.
Issue: Incomplete Updates
Score: Best practice
Result: No incomplete software update installations were found.
Additional System Information
Issue: Windows Version
Score: Best practice
Result: Computer is running Windows 2000 or greater.
Issue: Auditing
Score: Best practice
Result: This check was skipped because the computer is not joined to a domain.
Issue: Shares
Score: Best practice
Result: 3 share(s) are present on your computer.
Detail:
| Share | Directory | Share ACL | Directory ACL |
| D$ | D:\ | Admin Share | Directory ACL can not be read. |
| ADMIN$ | C:\WINDOWS | Admin Share | BUILTIN\Administrators - F, NT AUTHORITY\SYSTEM - F, BUILTIN\Users - RX |
| C$ | C:\ | Admin Share | BUILTIN\Administrators - F, NT AUTHORITY\SYSTEM - F, BUILTIN\Users - RX, Everyone - RX |
Issue: Services
Score: Best practice
Result: Some potentially unnecessary services are installed.
Detail:
| Service | State |
| Telnet | Stopped |
Internet Information Services (IIS) Scan Results
IIS is not running on this computer.
SQL Server Scan Results
SQL Server and/or MSDE is not installed on this computer.
Desktop Application Scan Results
Administrative Vulnerabilities
Issue: IE Zones
Score: Check passed
Result: Internet Explorer zones have secure settings for all users.
Issue: Macro Security
Score: Check failed (non-critical)
Result: 3 Microsoft Office product(s) are installed. Some issues were found.
Detail:
| Issue | User | Advice |
| Microsoft PowerPoint 2000 | ROCKET\HP_Administrator | Macro security is set to medium, which will allow you to choose whether or not to run potentially unsafe macros. |
| Microsoft Excel 2000 | All Users | No security issues were found. |
| Microsoft Word 2000 | All Users | No security issues were found. |
-
SherriBabee
- Regular Member
- Posts: 104
- Joined: Mon Jul 25, 2005 9:15 am
- Location: Amboy, IL-USA
Kevin,
you need to have these Services.msc running:
'Remote Registry, Server Service, Workstation service" ... Try it again then
Rgds
Sherri
p.s... MBSA.exe should ONLY need remote TCP port 80 open... Nothing else AND you can disable the "Remote Registry and Server Services" after your done with them... Workstation should always be on in XP
you need to have these Services.msc running:
'Remote Registry, Server Service, Workstation service" ... Try it again then
Rgds
Sherri
p.s... MBSA.exe should ONLY need remote TCP port 80 open... Nothing else AND you can disable the "Remote Registry and Server Services" after your done with them... Workstation should always be on in XP
-
ghettoside
- SG Elite
- Posts: 5134
- Joined: Thu Mar 13, 2003 5:18 pm
- Location: At Large in the US
w/o me going any further tonite...
I believe you can disable that HP_Admin account... but I'm confused... you can't see it in users from control panel, correct?
I have a job interview in the morn, I have to get some sleep.
Please... do not turn off or on any friggin services... I have what I wanted from the tool for now.
I believe I read somewhere something about some hidden admin account in some HP's...
I believe you can disable that HP_Admin account... but I'm confused... you can't see it in users from control panel, correct?
I have a job interview in the morn, I have to get some sleep.
Please... do not turn off or on any friggin services... I have what I wanted from the tool for now.
I believe I read somewhere something about some hidden admin account in some HP's...
Norm wrote:
There are idiots everywhere.
At work, in forums, in poetry classes, everywhere!
-
SherriBabee
- Regular Member
- Posts: 104
- Joined: Mon Jul 25, 2005 9:15 am
- Location: Amboy, IL-USA
GS,
He does need those 2 services running tho for MBSA to work, I just ran it lastnite again to check stuff on my system...
MBSA 2.0 FAQ
Forget what it says about the PORTS other than TCP-80
Rgds
Sherri
He does need those 2 services running tho for MBSA to work, I just ran it lastnite again to check stuff on my system...
MBSA 2.0 FAQ
Forget what it says about the PORTS other than TCP-80
Rgds
Sherri
I checked and those services are running....?SherriBabee wrote:Kevin,
you need to have these Services.msc running:
'Remote Registry, Server Service, Workstation service" ... Try it again then
Rgds
Sherri
p.s... MBSA.exe should ONLY need remote TCP port 80 open... Nothing else AND you can disable the "Remote Registry and Server Services" after your done with them... Workstation should always be on in XP
LOL..Ok you got it. Everything stays the same. I know what i can do with just a few minor changes and can't go that route anymore..ghettoside wrote:w/o me going any further tonite...
I believe you can disable that HP_Admin account... but I'm confused... you can't see it in users from control panel, correct?
I have a job interview in the morn, I have to get some sleep.
Please... do not turn off or on any friggin services... I have what I wanted from the tool for now.
I believe I read somewhere something about some hidden admin account in some HP's...
-
YARDofSTUF
- Posts: 70006
- Joined: Sat Nov 11, 2000 12:00 am
- Location: USA
Those accounts all look normal to me.
This is a prebuilt HP system?
The HP admin is probably there to do some kinda HP backup and restore(to the condition it was purchased in) probably not needed for the install from the hidden partition though(assuming thats intact)
ASP.NET like Sherri said gets created when you install .NET 1.1 basically never used, but I would leave it.
This is a prebuilt HP system?
The HP admin is probably there to do some kinda HP backup and restore(to the condition it was purchased in) probably not needed for the install from the hidden partition though(assuming thats intact)
ASP.NET like Sherri said gets created when you install .NET 1.1 basically never used, but I would leave it.
-
ghettoside
- SG Elite
- Posts: 5134
- Joined: Thu Mar 13, 2003 5:18 pm
- Location: At Large in the US
That's exactly what I'm thinking YoS- on all points.YARDofSTUF wrote:Those accounts all look normal to me.
This is a prebuilt HP system?
The HP admin is probably there to do some kinda HP backup and restore(to the condition it was purchased in) probably not needed for the install from the hidden partition though(assuming thats intact)
ASP.NET like Sherri said gets created when you install .NET 1.1 basically never used, but I would leave it.
Norm wrote:
There are idiots everywhere.
At work, in forums, in poetry classes, everywhere!
-
ghettoside
- SG Elite
- Posts: 5134
- Joined: Thu Mar 13, 2003 5:18 pm
- Location: At Large in the US
I'm not familiar w/ HP recovery... like I said earlier, I wipe that PE crap out.
I've run Compaq recovery a few times (and promptly deleted the OS and clean installed after I saw how they ran)
anyway, both Compaq's had 2 options to recovery... Destructive or Non-Destructive. I have tried both, and they both suck.
The non-destructive, it replaces some critical system files... and reinstalls all the apps, etc... AND you keep all your docs and pics and stuff.
destructive puts it back like Day 1, all your data will be gone.
Both times... the problems w/ the OS were not cured by the restore, which btw takes several hours on a 1.8Ghz AMD. Then ntldr is compressed and I had to look up the command line commands to decompress it in recovery console.
Anway, do you have a pre-installed OS on that box? I assume you do as you didn't say otherwise when I asked earlier (or when I assumed that earlier lol).
I agree w/ YoS, I think you can disable that account. If the recovery partition is intact, I do not beleive you will need to access that Hp_Admin account.
You may also want to see if you can log in as HP_Administrator... and leave the password blank. If you can log on that way, you definately should kill that account, no admin account should ever be left with a blank password.
before you delete that account, you may want to create a new password protected admin account first, then delete that HP one and delete your existing one. If you can't see that HP_Admin account in users....
I've run Compaq recovery a few times (and promptly deleted the OS and clean installed after I saw how they ran)
anyway, both Compaq's had 2 options to recovery... Destructive or Non-Destructive. I have tried both, and they both suck.
The non-destructive, it replaces some critical system files... and reinstalls all the apps, etc... AND you keep all your docs and pics and stuff.
destructive puts it back like Day 1, all your data will be gone.
Both times... the problems w/ the OS were not cured by the restore, which btw takes several hours on a 1.8Ghz AMD. Then ntldr is compressed and I had to look up the command line commands to decompress it in recovery console.
Anway, do you have a pre-installed OS on that box? I assume you do as you didn't say otherwise when I asked earlier (or when I assumed that earlier lol).
I agree w/ YoS, I think you can disable that account. If the recovery partition is intact, I do not beleive you will need to access that Hp_Admin account.
You may also want to see if you can log in as HP_Administrator... and leave the password blank. If you can log on that way, you definately should kill that account, no admin account should ever be left with a blank password.
before you delete that account, you may want to create a new password protected admin account first, then delete that HP one and delete your existing one. If you can't see that HP_Admin account in users....
Norm wrote:
There are idiots everywhere.
At work, in forums, in poetry classes, everywhere!