All of a sudden I keep getting local users added to my terminl server. They are benben$$ and omkl$$$ format. I don't know what is causing it. I keep deleting them but they keep coming back. My server is locked down and nobody has any admin rights except me. Thanks.Kevin

Hello Kevin,Check and make sure you don't have any schedule job running a script or something..Also go to event viewer and look to see who is creating this accountsIsaac Oben MCITP:EA, MCSE

I see a login attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1-0 in the event viewer and it is user omkl$$$$, which I have deleted about 10 times already. I have no idea what this is. Kevin

Hi , MSv1_0 is the authentication packed used by the LSA to validate the credentials, when the user logins to the OS , the LSA calls an authentication package to check if it can allow a user to login or not . So when you key in your user name and the password , MSV1_0 accepts the user name and the password and validates against SAM database and later a corresponding SID and the access token would be created for the user which will be used for any ongoing communications ( process / threads )

Please tell me you were able to fix this! At the moment we have a dozen plus clients experiencing the issue with the "yawg$$$" account. Need to know how to remove.