Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of schemas/users that will be created in the database as part of the application install or setup.

Is there a list of these users, preferably with the 'source' (such as Standard oracle user, Application XXX)?

This would assist me in auditing which users are needed and which might be superfluous. Default passwords would also be useful to confirm that the defaults are not usable.

share|improve this question

An excellent starting point is the list on Pete Finnegan's website. [I'm not employed by him or his company. ]

Usernames in the format APEX_nnnnnn or FLOWS_nnnnnn (also APEX_PUBLIC_USER) are associated with the Application Express component of Oracle. This is an optional component in 9i and 10g, but is part of the standard install for an Oracle 11g database (and the XE edition of 10g).

share|improve this answer
Also not working for him, but he does have some bloody good Oracle security auditing tools. Check out – Rory Alsop Dec 30 '10 at 2:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.