Koldov Posted February 12, 2015 Posted February 12, 2015 Hi All, Just mooching around the old server and looking at things I have to think about moving when I upgrade it to 2012R2 so I'm listing all the shares. When I click on 'Manage Sessions' in 'Share and Storage Management' I find this... So I look up who has this laptop and march down to their classroom, thinking I must have left it logged on after some sort of maintenance and forgot to log off and they have been using it as Admin... But no, teacher is logged on as herself. No local admin user account has been given and they are not in any admin groups I can find on the Domain. What do I do? Are they ADMINISTRATOR or not? Anybody? Kol.
jamesreedersmith Posted February 12, 2015 Posted February 12, 2015 Hi All, Just mooching around the old server and looking at things I have to think about moving when I upgrade it to 2012R2 so I'm listing all the shares. When I click on 'Manage Sessions' in 'Share and Storage Management' I find this... [ATTACH=CONFIG]29160[/ATTACH] So I look up who has this laptop and march down to their classroom, thinking I must have left it logged on after some sort of maintenance and forgot to log off and they have been using it as Admin... But no, teacher is logged on as herself. No local admin user account has been given and they are not in any admin groups I can find on the Domain. What do I do? Are they ADMINISTRATOR or not? Anybody? Kol. How are the drives on that machine mapped - were they manually done with admin credentials and saved or is GPO set to use alternate credentials maybe?
sted Posted February 12, 2015 Posted February 12, 2015 could be someone has set up the av software to connect with the administrator username rather than emlibuser1 that Sophos uses for example. could be a startup script that "might" show up as administrator as they run in that users context
maniac Posted February 12, 2015 Posted February 12, 2015 Is Switch user enabled on your system? You didn't leave it locked and they logged on as themselves leaving the admin session running?
Koldov Posted February 13, 2015 Author Posted February 13, 2015 How are the drives on that machine mapped - were they manually done with admin credentials and saved or is GPO set to use alternate credentials maybe? Well the drives are now mapped through GPP, not sure how they were mapped originally - possibly manual with admin credentials, would disconnecting them all and letting GPP re-map them get around this? could be someone has set up the av software to connect with the administrator username rather than emlibuser1 that Sophos uses for example. could be a startup script that "might" show up as administrator as they run in that users context We use MSCEP and this also could have been installed with admin credentials, however I think that is pretty much standard here as are some of the initial drive mappings, so I would expect a much higher incidence than I am seeing. Is Switch user enabled on your system? You didn't leave it locked and they logged on as themselves leaving the admin session running? I went to see yesterday but the teacher wasn't there, laptop was on and open so I rebooted it which should have cleared out any other users logged-on and yet I'm still seeing it this morning... Kol
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now