1

Taking this to the extreme just to make it clear. What if I named a Local Windows 10 user name the user's social security number, or full name? Not concerned about local threats, just regular network usage, internet browsing, sharing folders locally on the local network. Is there any situation where the local Windows user name is exposed on the Internet or network?

I have searched and searched and cannot find an answer to this question. I have noticed that a Music Share on the local network does show the full user name on the other computers. Does this also reveal on the internet under any circumstances?

Again, no hacking, just normal usage.

migrated from serverfault.com Mar 6 at 1:54

This question came from our site for system and network administrators.

  • 3
    On the local network, yes. Not on the Internet. – schroeder Mar 6 at 8:15
1

Any decent programming language can get your windows username. Examples:

ASP

ASP can also use Membership.GetUser().UserName

PHP ca use AUTH_USER request variable and get that even if you don't login to a website.

So the answer is yes, internet browsing can reveal your Windows username at any time.

1

This depends on quite a number of factors, but the gist of this is that this can happen in two scenarios:

  • User is authenticated to a remote service (network share, website, etc.) with the Windows account
  • The protocol sends the username for simple identification

Both of these situations can apply within a private network or across the internet. However, authentication usually only happens to services you trust (such as configured by your corporate IT).

User identification is dependent on the protocol, but the services built in to Windows generally don't provide this information without consent from the user. Third party apps are welcome to do whatever they want.

That said, the username is usually not considered a secret piece of information in Windows because it can leak in other ways such as someone sending metadata like profile path info (e.g. c:\users\username\whatever).

So to answer your question directly: yes, there are situations where it's exposed. You can limit this by controlling which services are running.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy