The Invisible Administrator

Today something very weird happened and I doubt something this weird will ever happen again.

I was working on a site at school when I browsed to a file-server to check some paths, and to my surprise I could suddenly access all shares, not only the ones for students, but all of them…

When I tried creating files they got made under BUILTIN\Administrators! But I was logged on with my own student account. So, being nice and all, I reported it…

Then we spent almost the entire afternoon trying to determine why I was suddenly an admin.

And this is when the weird stuff started to happen:

• On PC1 I was an admin on the server, but when I logged in to PC2 I couldn’t access it.
• We tried different student accounts on PC1, but they also couldn’t access the shares.
• Then we removed all groups from my account except Domain Users, and I still could get in.
• We cleared the profiles from PC1 and PC2 and also deleted my roaming profile.

Nothing changed…

First conclusion: It’s tied to username X and PC1, examine PC1 later.

Then we went to another room and tried it on different computers. And there it started all over again. PC3: I’m an admin, PC4: I’m not.

In the end we checked all groups I belonged to, and their membership, deleted my profile, checked all NTFS permissions (which I could change as well…), and there was no trace of me or any groups I belonged to anywhere. Nothing had admin rights.

We forced replication to make sure I was group-less but it still worked!

Conclusion: User X has the rights of an admin, but does not show up in any group, NTFS permissions or anything else…

Solution: We disabled the account and created a new account… (which means I have to recreate my entire profile…)