How Windows 2003 Server sets up a single administrator

Let's start with the admin problem, hackers add admins via ASP or SQL databases.

If you're using SQL, the best thing to do is to disable cmdshell, so that even if a hacker gets SA privileges, they won't be able to add administrators.

See for detailed methods.

As for adding administrators via the ASP Trojan, the best way is to use the and component, of course, this requires that your ** program will not use this component, otherwise it will be a waste of food.

See for detailed methods.

The best way is to install a firewall, only keep the necessary service ports (for example, **Yes is 21, etc.), remember to close high-risk ports such as 3389, and then add a rule to open all ports to the specified IP, and that's it.

I'm here to add ... You delete or disable unnecessary accounts. Get rid of the username of the administrator's account.。。

Who hacked your administrator account??。 Other accounts simply cannot create an account in the administrators group. Then there's adding those guest account groups to a rejection group that you created, and he is also rejected for copying...

Also do you review the relevant issues in Group Policy to modify it.。。 There's a lot of it in there. No matter how powerful anyone is, they can't remember it all.

There's a lot of stuff in there. Slowly checking it out. YTT12345 above is just a reinforcement problem.

If you do the most basic problems well, the remaining small problems will be solved step by step.

I said that the username of the administrator account should be dropped. How can you change the name of the administrator group at will!

What is the size of your company?

IPsec security policy can effectively restrict users from using the terminal to log in, now many ** have injection vulnerabilities, if SQL check whether there is an overflow vulnerability in port 1433, and whether there is an SA air password in SQL, check whether the remote terminal has an input method vulnerability, this is often overlooked, there may be a security risk.

1. Right-click "Computer" and select "Manage". Click Yes in the pop-up User Account Control window to open Computer Management.

2. Or press and hold the Windows logo key and the R key at the same time to enter the run, enter 3, select the administrator account (administraor), and select properties.

4. Uncheck [Account Disabled] and press OK to save.

In the control panel - users, you can see below, but if you are a restricted user, you can't see it, restart the computer, boot and press f8 to enter the safe mode, in the control panel - users, you can view, you can also change yourself to the computer administrator, or change the administrator's password, but you need to ask for the administrator's consent when doing these operations!

Right-click on My Computer - Manage - Local Users and Groups - and then right-click your Users - Properties - Affiliations to delete and add groups.

Right-click on My Computer, Manage, Local Users & Groups, Users, on the right, select the account you want to give administrator privileges to, right-click Properties, Affiliate, Add, Advanced, Find Now, select Administrator, OK, OK, Apply. Hope it helps you a little.

1. Press win+r or click Start --- all programs --- run in the running dialog box, and enter the registry command regedit to open the registry window.

2. In this window, hkey local machines software microsoft windowsnt current version winlogon key value.

3. In the corresponding right subwindow, right-click on the blank space, and execute the "New" and "String" commands from the pop-up shortcut menu to create a string key, set the key name to "autoadminlogon", and set the value of the key name to "1".

4. Find the "defaultdomainname" key, double-click it with the mouse, and enter the domain name you want to log in to in the window that appears, such as department.

5. Double-click the "defaultusername" key name, and in the window that opens, directly enter the username you want to log in to this domain, such as "administrator".

6. In the sub-window on the right side of Winlogon, right-click the blank space with the right mouse, and execute the "New" and "String" commands from the pop-up shortcut menu to create a string type of key name, and set the key name to "defaultpassword", and set the value of the key name to the password of the user to log in to the system

I also want to know the answer, damn every time I board it, a bunch of administrators find a way:

Log in to your 2003 server with an administrator account, click "Start - Programs - Management Tools - Terminal Services Configuration", open "Server Settings", you can see an option on the right side "Limit each user to use one session", and start this function.

I tried it and it didn't seem to be like this, and I got the desired result by the following method: "Start -- Programs -- Administrative Tools -- Terminal Services Configuration -- Limit one session per user" is fine.

In fact, the administrator account of all Microsoft systems is to add the ordinary account to the administrators group, and inherit the larger permissions from the group.

Here's how:

1. Open the management tools under the control panel, enter the computer management, or right-click on the My Computer (Computer) icon to select Management or enter the computer management, and then create a new user in the local users and group users on the left side of the computer management interface, right-click on the user name to select properties, open the affiliation, find the administrators group, and add it to the group;

2. You can also add it through the command line, open the command line window, run "net user username add" in the window to create a new user, and then enter "net localgroup administrators username add" to add the newly created username to the administrators group.

Start -- Run Control UserPasswords2 to identify a user account.

Click Add Enter your account name in it -- click Next to select Other, and select Administrator in the Other box

First, create a normal user in the user group, click Properties, and add the newly created user to the administrator group under the affiliation option.

Start --Run Enter control userpasswords2 OK.

Come out with a user account.

Click Add Enter your account name in it -- click Next to select Other, and select Administrator in the Other box

With the exception of the Administrators group, which can create, modify, and delete users, only the PowerUsers group can do these actions. If you want to give him additional permissions, you can add the user to multiple local groups. For example:

The user you create must have basic operations and the right to create, modify and delete users, and you can add this account to the users group and the powerusers group respectively. You can give it a try. If you're a domain, just ask the administrator to delegate the user.

To be able to create and delete users, you must have administrator privileges, and of course, larger system privileges are also acceptable. I don't know what your purpose is, there should be a way to replace it.