I was able to create an invisible user in windows 7 and 8.1.

The user is not visible at the login Screen, I added it to the SYSTEM account group and Remote desktop Users Group, The Administrator can know about this user via Computer management > Users and Groups option and using Net User Command in the shell, This user could not gain SYSTEM privliges though I am trying.

But the question is when I RDP into some host, The Local User does not know it is being RDP'ed.

How will the Administrator know when this invisible user does some malicious activity like deleting a file etc. as it is invisible in event log?

You can also use PsExec using -u and -p option for username "sys" and password "007" to log into invisible user through command shell via your other account, and you can RDP using invisible user that's it. Why do they exist?

Please delete this question if I am wrong and I don't know enough, I want to know from experts like you.

closed as unclear what you're asking by Xander, AJ Henderson, Stephane, TildalWave, user10211 Oct 27 '14 at 14:23

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


You are wrong. It still shows up in the event logs and the computer knows if it is an RDP session. You can see that there is an active RDP connection if you have the right tools up as well. What you are talking about isn't an "invisible user", it's a service user, and it is an intentionally designed feature of Windows, not a security hole. You just aren't familiar enough about working with them and where they are logged. Service users actually make Windows more secure because they allow automated processes to be configured with the least permissions they need without compromising the account credentials and access of the user account. They also allow for services to be configured to run on a users behalf without having to give the user deeper levels of access to the system.

Additionally, if a user could access your computer well enough to establish a user like that, there is no reason they would need to create a user. Loading a rootkit or a remote access trojan would allow for control of the user's computer without leaving a user account behind. Some activity would possibly still end up in event logs for a simple remote access trojan, but a decent root kit could even subvert the system logging.

The attack scenario you describe is not a particularly viable attack scenario and isn't a security flaw, but rather a designed feature of Windows, implemented to improve security.

  • i appericiate your answer but it is not a service user it has a password and it has low privilages,if i am wrong please tell us what is a service user and i didn't edited HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services for this tweak .please help – raven Oct 27 '14 at 13:43
  • @raven - service users should have passwords and can have low priviledge if that is all they need. They also don't have to be associated with a windows service, that's something entirely different from a service user. Service users can be used for a number of other reasons. Often they are configured to not allow being used by a user for logon, but sometimes they have to be able to login and act like a user. Putting a user in both Services and Remote Desktop Users is a bit odd, but still not a security concern as the behaviors are still logged on a properly configured box. – AJ Henderson Oct 27 '14 at 13:49
  • 1
    In other words, the behavior you describe is not a security issue and is working as intended. – AJ Henderson Oct 27 '14 at 13:49
  • Service users i think should have some associated service with them and further create their profile in registry but my user is different,it can browse the whole machine and create files and folders and does not have any user profile in the users folder on the system drive...why -rep – raven Oct 27 '14 at 13:56
  • 1
    @Raven - you think incorrectly. They could also be used for scheduled tasks, configured to be the user that runs a link for a user, or any of a number of uses where a process has to occur on a privilege set other than a normal user. You shouldn't have to tweak anything in the registry for them. That would be horribly unusable and lead to errors, which would be bad for security. It doesn't have a user profile because it doesn't need one. Again, this is working as designed and is not an issue, you simply don't understand their usage correctly. – AJ Henderson Oct 27 '14 at 14:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.