Domain users being added to Administrators

[Guest thajuggla4478]

Hello all,

 

I have ran into a problem where our doamin users group is being added to

our administrators group nightly. I have tried several different things, but

to no avail. I am beginning to suspect that we have a hacker running loose

on our network here. Is there a way that I can lock this out short of using

the GPO?

 

Thank you,

Brett

[Guest Mathieu CHATEAU]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

Hello,

 

does this occur only at night or after every reboot ?

 

Is it the domain admins group or the local administrators group ?

 

If it's domain admins, review the group membership, and change all

password of member's account

 

If it's local admin, it may be already a GPO, or scheduled tasks

 

Cordialement,

Mathieu CHATEAU

french blog: http://www.lotp.fr

english blog: http://lordoftheping.blogspot.com

 

 

thajuggla4478 a écrit :<span style="color:blue">

> Hello all,

>

> I have ran into a problem where our doamin users group is being added to

> our administrators group nightly. I have tried several different things, but

> to no avail. I am beginning to suspect that we have a hacker running loose

> on our network here. Is there a way that I can lock this out short of using

> the GPO?

>

> Thank you,

> Brett</span>

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (MingW32)

Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

 

iEYEARECAAYFAkjX3C4ACgkQR16rF5v5prD+zwCeOHBJgLE9q5uzvW9OKgGqZYJw

P8MAn2+tmiXp9u20f0bZHsTyDkXf6BiJ

=+13k

-----END PGP SIGNATURE-----

[Guest thajuggla4478]

Thank you for the fast response.

 

It happens every evening. I have not had it happen during a reboot.

 

It is the Local Administrators group.

 

Thank oyu for the help,

Brett

 

 

 

"Mathieu CHATEAU" wrote:

<span style="color:blue">

> -----BEGIN PGP SIGNED MESSAGE-----

> Hash: SHA1

>

> Hello,

>

> does this occur only at night or after every reboot ?

>

> Is it the domain admins group or the local administrators group ?

>

> If it's domain admins, review the group membership, and change all

> password of member's account

>

> If it's local admin, it may be already a GPO, or scheduled tasks

>

> Cordialement,

> Mathieu CHATEAU

> french blog: http://www.lotp.fr

> english blog: http://lordoftheping.blogspot.com

>

>

> thajuggla4478 a écrit :<span style="color:green">

> > Hello all,

> >

> > I have ran into a problem where our doamin users group is being added to

> > our administrators group nightly. I have tried several different things, but

> > to no avail. I am beginning to suspect that we have a hacker running loose

> > on our network here. Is there a way that I can lock this out short of using

> > the GPO?

> >

> > Thank you,

> > Brett</span>

> -----BEGIN PGP SIGNATURE-----

> Version: GnuPG v1.4.9 (MingW32)

> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

>

> iEYEARECAAYFAkjX3C4ACgkQR16rF5v5prD+zwCeOHBJgLE9q5uzvW9OKgGqZYJw

> P8MAn2+tmiXp9u20f0bZHsTyDkXf6BiJ

> =+13k

> -----END PGP SIGNATURE-----

> </span>