Win2003 Create a forever hidden account of the graphic tutorials _ Security Tutorial

Some time ago a more popular word "meat machine" in fact, to control the remote computer, then I would like to hide the user account is not the problem, in fact, create a hidden user account is relatively simple, and now I will create a hidden user account to tell you.

In fact, each user account in the registry has its own account data items

First let's look at what the administrator's data items are in the registry (figure below)

Figure 1

Operation one, open the registry: Hkey_local_machine\sam\sam

The SAM is where the user account is saved, but this "item" is not visible by default. If we want to see what's inside, we have to authorize it first. (It is recommended that a friend who is not familiar with the registry should not change the registry casually)

Operation II, understanding the registry of account classification

The user account in the OS, whether it's a built-in account or a post-build account, can be seen in the registry. But there are two accounts you must be able to know, that is the Administrator account and Guest account number. (pictured below)

Figure 2

In this figure "000001FA4" represents the administrator account, even if the administrator account has been renamed this value will not change, so we can use this value to determine the renamed Administrator account.

"000001fa5" means the guest account, and the same value is not changed because the Guest account is renamed. The rest of the remaining values are basically the user accounts that were created later, and the values are generated. After recognizing the registry, now we have to use the "net User" command to create an account, create a hidden account must be under CMD. With this set of commands, a friend who is unfamiliar with this command can refer to one of my other articles about common commands, but these commands can also be found in the help of the OS.

Operation Three, create an account with the "net User" command

First, to establish a hidden user xbx$ 1, net user xbx$ 123,abc/add here means that the establishment of a xbx$ account password is 123,ABC (the following figure)

Figure 3

1, C:\Documents and settings\administrator>net localgroup administrators xbx$/add here means to put xbx so that we create users with administrator privileges.

First, observe the changes in the registry, and make the appropriate changes to the registration form. Hkey_local_machine\sam\sam

1 , find the user account we just created ( as pictured )

Figure 4

In this picture, we can see that "000003f6" is the newly established "Xbx

2, Multiple account rights replication in the registry

Locate the Hkey_local_machine\sam\sam\domains\account\users item, open the "000001f4" item, and then open "F" (the following figure).

Figure 5

Then put the values in this, select all, paste and overwrite the "F" value of "000003f6".

3, Export Registry Values

Now "000001f4", "000003f6" and "Xbx" in the Registry

Figure 6

4, Delete Account

Next we go back to "CMD" to remove "xbx

Figure 7

When you delete an account, the value in the registry is gone, and then we import the registry key that we just exported into the registry. This time we open "local computer users and groups" and can't see the XBX