1st, increase “$” mark hideaway account
Is quite simple regarding this kind of hideaway account's examination. Generally the hacker after using this method establishes the hideaway account, the hideaway account promotion for the manager jurisdiction. Then we only need in “the order prompt symbol” to input “net localgroup administrators” to be possible to let all hideaway account reveal true colors. If dislikes troublesome, may open “the computer management” to carry on the examination directly, the increase “$” the mark account is unable in here to hide.
2nd, revision registration phenotype hideaway account
Because will use this method hideaway the account not and “the computer management” sees in “the order prompt symbol”, therefore may arrive in the registry to delete the hideaway account. Arrives at “HKEY_LOCAL_MACHINE \ SAM \ SAM \ Domains \ Account \ Users \ Names”, has the account which here the account and “the computer management” exists to carry on the comparison, comes out the account was hides the account. The wish deletes it to be very also simple, the direct deletion hides the account naming the item then.
3rd, is unable to see the name the hideaway account
If the hacker has manufactured a revision registration phenotype hideaway account, based on this deleted the manager to the registry operation jurisdiction. Then the manager is unable through the registry to delete the hideaway account, even is unable to know the hacker establishes hideaway account titles. However the humans affair absolutely, we have not been possible to draw support from “the group strategy” the help, lets the hacker be unable through the hideaway account debarkation. The click “the start” -> “the movement”, the input “gpedit.msc” the movement “the group strategy”, launches “the computer disposition” in turn -> “the Windows establishment” -> “the safe establishment” -> “the local strategy” -> “the verification strategy”, right side the double click “the verification strategy change”, in the establishment window which springs cancels chooses “the success”, then the spot “determines”. Right “the verification debarkation event” and “review process tracing” carries on the same establishment.
4th, the starting debarkation event verifies the function
After carrying on the debarkation verification, may carry on the record to any account debarkation operation, including the hideaway account, we may adopt “the computer management” like this “the event examination” the accurate knowing hideaway account name, even the hacker lands time. Even if the hacker all debarkation diary will delete, which account the system will record will also be deleted the system log, such hacker's hideaway account exposed without doubt.
Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * Next>>
|
You are here: hacking technology
> invades the examination
> Content
Category: Home
> invades the examination