During a test for my certificate of apprenticeship, I got a demand to make my domain controller hide the users who where previously logged on to the Windows clients.

Exactly what are the purpose of this? Does it offer any advantages over security, or is it just completely pointless?

It's not hard to find out who was on the client by simply looking in the C:\Users folder. And if you don't have access to the client at all: You could just rip the hard-drive out and load it up on a different machine and still see the folders.


If you have no credentials or physical access, getting valid user IDs (for example at the logon screen through an RDP session) is a step forward in gaining access to the machine. Some of the users might have weak passwords which are easy to guess or brute-force. Missing the info about which users are valid makes these attempts much harder. You could also gather valuable insights about which individuals work at certain computers, and thereby determine which people might be interesting targets for social hacking attempts.

As you said, if you already have access to the box through proper credentials or physically, it doesn't help at all. But in a scenario where you don't, it certainly makes sense.

  • 1
    "if you already have access to the box through proper credentials or physically", or when you know what the logins are (in an enterprise context for instance, where you have access to the directory). This said - good answer.
    – WoJ
    Jan 27 '17 at 9:41

Apart from the fact that you can gather target usernames for attacks against those users there is also a privacy issue. Where usernames can identify individuals, displaying this to any person with physical sight of, or access to, the workstation breaches the privacy of the previous user.

Knowing that someone was logged in, and who they were, and that nobody had logged in since, is all potentially sensitive information. In addition, displaying the previous username may reveal the 'pattern' of usernames chosen by the administrator who created the account username.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.