Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 10 subscribers
  • Views 5455 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

authority nt \ system

Tiago Toledo

authority nt \ system

When adding some users began to appear a user with this name: authority nt \ system
What is it? Bug? How to solve this problem? Follow print below



This thread was automatically locked due to age.
  • 0

    Now there are two accounts that appear that we do not know why. How to proceed with this situation? Has anyone had this problem? Can I delete these two accounts?

  • 0 in reply to Tiago Toledo

    Hello ,

    both accounts are predefined (builtin) accounts (NetworkService being the third) - Windows processes and most services run under one of these accounts.
    What do you mean by can I delete - delete the from the endpoint?

    Christian

  • 0 in reply to QC

    No, I ask about delete from SOPHOS console. This situation is normal? Already happen with you or somebody?

  • 0 in reply to Tiago Toledo

    Hello Tiago Toledo,

    I'm afraid, I'm not using Central. The Central Admin Help doesn't mention these accounts or with which user detections in a system context (i.e. where one of these accounts accesses a file) are associated. Maybe some Central expert (?) can clarify. I'm not familiar with the GUI, though I assume that in the screenshots the column to the right of the detection lists the device and it seems the Central Admin automatically consolidates the builtin accounts.

    Christian 

  • 0 in reply to QC

    Central maps devices to the users via the login. I.e.

    User <--> Login <--> Computer

    You can delete a User and the Login and Device will remain in the system.  So you can create a new User, attach the exiting Login to it and the Computer will be linked.

    Hopefully that makes sense.

    So when you deploy to an endpoint, you can create a User (with email) up front and email them an installer link from Central.  When protected and messages in, it will automatically link the User to the Computer.
    If you just use the generic installer from the Downloads page, when the computer messages in, it will create a new user from the login so in effect you have:

    User (same as the login) <--> Login <--> Computer
    You can rename the User to be more friendly than the login if needed.

    There is also the scenario where you deploy to a computer when no one is logged in.  E.g. as startup script. At that point, the User can't be created from the login as there isn't one, so I thought it created the User name from the Computer Name.

    I can only think that the User you see was created when no one was logged on to the endpoint.  Maybe there was a process where the System user was logged on interactively and the MCS software on the client picked up Loacal System as the account to create?  Seems odd.

    In any case the User can always be changed/deleted/created

    Regards,
    Jak

Unfiltered HTML