Why is the pla group hidden?
Well,I hope this question is not a repeated one.I occasionaly glimpsed that there is such a group, and it has certain rights on data collector sets.My first thought is "Oh,I am finally compromised by those d*** ".And after being mad for couples
of seconds,I came back to myself and started pondering:since I was working on performance logs,maybe this group is related to those works,just oddly that I didn't remeber having seen it. And in fact it can not be found in users and groups,although according
to articles here,it seems to be something like that. I knew there is a way to add hidden users by editting registry,but I forget the key,and searching "pla" through registry is a work too heavy. Is there any other hidden groups or users in Windows?Why
are they hidden? Anyway,it is just that the name...it is given a meaning that is not very nice.
December 22nd, 2011 4:52am
Oh,sorry.I suddenly realized that I went in the wrong way.
Yes,it is a special group.Just like SYSTEM and CREATOR OWNER,which are built into the system and only show themselves in security-related dialog boxes.Their icons are at first the same to the icons of the other groups in security dialog boxes.But in the dialog
box of select users,computers or groups,the icons are different,marking them as different kind of group.
A remaining matter is,the pla group is restricted more than the others.It even can't be seen in the select users,computers or groups dialog box.So this way of assigning rights to it is blocked.However,according to it's original purpose,it shouldn't be assigned
too much rights.
OK,my mind was jumbled with it's name.It seems that it is not until today that I sober up.
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2012 8:39am
Hi,
Would you please let us know what articles you have read regarding hidden users?
As far as I know, there is no built-in hidden groups or users.
To create a hidden user account:
1.Run Registry Editor (RegEdit.exe).
2.Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Note: If SpecialAccounts and UserList is not found, create new sub-key and name them accordingly.
3.Select UserList, and in the right pane, right click on any blank space, and point to New -> DWORD (32-bit) Value.
4.Name the new DWORD registry value name as the exact same name that match the name of the user account to be hidden.
For example, if the user ID of the user account is John, the name the registry value as John.
5.Double click on DWORD registry value, and set the value data to 0 in order to hide the account from Welcome Screen.
Tip: To display the user account on Welcome Screen again so that it’s visible again, delete the registry entry, or set the value data to 1.
6.Exit Registry Editor.
7.Log off or restart computer to make the change effective.
Regards,Arthur Li
TechNet Community Support
February 4th, 2012 11:47pm
Hi,I refered the following articles:
http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/9d0883ce-bb34-48a0-a4e8-2a7c2fbe6f78
http://msdn.microsoft.com/en-us/library/windows/desktop/aa372634(v=vs.85).aspx
The group can be seen when you open performance monitor--data collector sets-- either user defined or system--property dialog box of any data collector set--security tab.
I tryed to access this group theses days, but it's very unusual:
It can not be seen in users and groups.
It can not be found using DS commands:
dsquery group -name pla returns empty.
Since it is related to performance monitor,normally it should be in the builtin OU,but we can not add users or change other properties with this guessed DN.Neither dsmod nor Powershell.Perhaps it's somewhere else?I'm not used to Powershell and not sure whether
it has a way to query objects.
I looked for the registry key you mentioned,and it is not yet created on the system.I meant to use registry to access it's properties,so it seems that other ways are needed to be found.
It becomes interesting how it is hidden,maybe it's creation relates to former editions of system. Thank you for your reply.
Free Windows Admin Tool Kit Click here and download it now
February 5th, 2012 5:20am


