Unknown User account appears on login page

Hi,
Recently on my Login Page an unknown user has appeared on my computer. When I go to administer accounts the unknown user does not appear.
It has it's own avatar too...a human shadow with outer space in back of it.
I recently set up a myspace.com account, but that should not have done it.
I cannot get this thing off my computer and I fear I am being hacked.
Can anyone help me get rid of this thing and/or explain to me what it is?
Thanks, RWard

Gill
Welcome to Apple Discussions!!
I went to the link you noted but was unable to find 'security' in the linkTrue, all it says there is
The root user should only be used for specific administration or monitoring tasks. After completing a task as the root user, log out of Mac OS X and log back in using a normal or administrator user account.
Disable root access if you do not use it often.However, if anyone does manage to hack into your machine, he can do more damage if there is an enabled root account (he still has to guess the password of course). If root is disabled, that's another barrier.
If you are really interested, see Mac OS X: Security, and this PDF document: Security in Mac OS X

Similar Messages

Guest user account won't login

In OS 10.10.2 the guest user account won't login, all we get is the spinning ball.
How do I fix the problem?
-Patrick

Please read this whole message before doing anything.
This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.
The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.
Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem. You must hold down the shift key twice: once when you turn on the computer, and again when you log in.
Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.
Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.
The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.
Test while in safe mode. Same problem?
After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

How to change the order of users in appearance of login screen?

Hello!
Because we often switch to a user,
which is listed last in login screen,
we want move them to the second place.
How to change the order of users in appearance of login screen?
Thank you for a tip
Erhy

The order users show up on the login screen is the way they are ordered under the
C:/Users directory. This is usually alphabetical, AFAIK there is no other way to change the order other than to change the username to something that starts with a letter that will be higher alphabetically.

Unknown user account

I have Windows7 RC on my system, earlier i had windows xp SP2. Recently i noticed an unknown user account (S-1-5-21-XXXXX......) in the security tab of few of the folders/files. But this user does not show up in the local user group in the control panel. Any idea what this account is and how to remove it?

I know this thread is 4 years old, but there doesnt seem to be a better one so I'll respond here.
This is actually pretty easy to fix (really! like 30 sec).
Right click on the root drive
go to security
click advanced
tick @"replace all child..." at the bottom and then
change the owner at the top (even if you have the right owner for this object)
pick a new owner (eg your admin)
now back at the advanced security settings screen tick "replace owner on subcontainers"
make sure youve got the right level of access (eg full control)
click apply
wait. :)

New Users Not Appearing On Login List - Help!

Hello Mac geniuses,
I run a 10.3.9 network in an elementary school, and I since returning from summer vacation I have had problems with many of my client eMacs not displaying the names of users I have added in WGM. These eMacs are also still displaying the names of accounts I have deleted.
If anyone is kind enough to help a stranger, I have copied below the transcripts of my email exchanges with an Apple tech, in my struggle to get my school functioning again. (I have placed them in the correct order so the 1st email is on top and the last on bottom. The tech's name is John and I am using "Jon" to make it slightly less confusing!).
My very grateful thanks in advance to anyone who can help me.
Jon
On Sep 5, 2006, at 3:28 PM, Jon T wrote:
Hi John,
After deleting and adding users in WGM, some login screens still show deleted users and do not display the new users.
I tried deleting the MCX cache via NetInfoManager on the clients, and even restarted the server, but it has not affected several machines.
Any advice?
Server: Dual 1Ghz G4 (Mirror Door) running Panther Server 10.3.9
Clients: eMacs running 10.3.9
Thanks in advance.
On Sep 5, 2006, at 3:47 PM, John G wrote:
Jon,
Go into the client as the admin account.
Delete /Library/Preferences/Directory Service
Restart and setup Directory Access in Utilities
Let me know if that works.
John
On Sep 6, 2006, at 9:08 AM, Jon T wrote:
Hi John,
Thanks for replying. unfortunately, that didn't work either . . .
Jon
On Sep 6, 2006, at 2:03 PM, John G wrote:
Jon,
Are you sure the machine is on the network and talking to your
server?
Go into Dir Access and uncheck LDAP and readd the server.
On Sep 6, 2006, at 4:07 PM, Jon T wrote:
Hi John,
Yeah, they're on the network, students can log in using the "Other" option, I can connect to the server and mount shared folders, etc.
I did as you said, rebooted, still no updated list.
Jon
On Sep 6, 2006, at 8:57 PM, John G wrote:
Jon,
Netinfo is probably corrupt.
Follow these directions to blow out Netinfo to create a new one.
Bind back to server.
<OS X frozen while booting.pdf>:
AFP548.com: Articles: NetInfo Recovery Techniques
NetInfo Recovery Techniques
Joel Rennich, [email protected]
4 June 2002
When working with NetInfo, which we are and hope to have some more articles on in the near future, it is important to know
how to back up to a previous version of your database.
1. First, the most brutal way of recovering from a nonfunctional database.
Boot into single user mode by holding down the "s" key while starting up. Follow the handy instructions Apple gives you at the end of the startup sequence and run fsck. Then mount the system root disk as read/write with:
mount -uw /
Now you can get on with recreating your database in a very brutal way. Remove your current database with:
rm -rf /var/db/netinfo/local.nidb
Now remove the file that prevents the Setup Assistant from running:
m /var/db/.AppleSetupDone
And now reboot to get things rolling.
reboot
This will cause the Setup Assistant to launch, complete with music and bouncing blue blobs. If you remember which account you set up first when you last saw this screen, set up that account now. Otherwise, go with whatever you want for your first
Administrator account. If you match it up with the original Administrator account, all of your permissions should be groovy.
Otherwise, get familiar with chown and chmod and you will be able to set things right.
The above method is rather draconian and isn't for times when you need to replace a complicated NetInfo setup, but should work perfectly well for an essentially single user machine. However that probably rules out most Servers.
On Sep 7, 2006, at 8:15 AM, Jon T wrote:
Hi John,
I performed that protocol, but even that didn't fix the problem!
I know I've heard someone once suggest (in a moment of resignation) that I just use the blank name and password fields at login, but this is not really an option in elementary school. I only have 478 users in WGM, so I can't believe that would be too taxing for OS X Server!
Thanks again for your thoughts on this.
Regards,
Jon
On Sep 7, 2006, at 9:53 PM, John G wrote:
Jon,
The last resort is to reimage.
Are you managing computers by Guest computers or
computer groups?
John, we're talking about 23 computers here - re-imaging is not an option for me alone unless I have some technical assistance (I don't know how to 'ghost' images across a network).
I was managing the users by Groups though I did have a list of the computers called "lab computers". I just noticed that when I try accessing the Computers tab in WGM (whether on my teacher's station or on the server itself) I get the same error message:
Got Unexpected Errror
Error of type -14136 on line 432 of
ComputerListPluginView.mm
Please advise!
Thank you again,
Jon

The list of users is a plist file and should be at at /Library/Preferences/com.apple.loginwindow.plist on the clients. See this thread for more information:
http://discussions.apple.com/thread.jspa?messageID=2368769&#2368769
If you've got a good plist from a client that sees the right users, you should be able to copy it over. If not, try backing up the file from one client and then deleting it and restarting.

Is there a way to audit user accounts by last login date/time?

Hello all,
Is there a way to see or report on a user's last login. I don't see a last login date parameter in the UM record. I see that all security events are logged in the security log including logon and logoff, but what I need is to be able to produce a report that provides all user accounts which have not been logged on to since a specified date or # of days, i.e. since 01/01/2008 or >180 days.
Any clues or guidance is appreciated.
Regards,
Paul

Is there a SAP / Portal standard way of accessing this information?
Our authorisations team have asked me to get them such a report, and I can't find anything on the portal (NW2004) that would give this information. I don't think the basis guys would be terribly chuffed to provide access directly to the database. If this (database access) is the only way, then I suppose a custom developed app could be created and deployed to the portal, but I would have thought this is a reasonalby sensible report so would be standard content somewhere.
Cheers,
Andrew

Remote user Authentication in customize login page

Hi all,
I would like to make sincere request to all you that I am not able authenticate my users based on tables. I start to learn HTML DB before 20 days and created simple application.
Requirement:
1: Created new login page P16 other than inbuilt login page 101.
2: created table “trx_employee_login” which will keep track of user information
3: after giving URL to user if user enters usr/passwd then it should take username and password (remote ) and validate in “trx_employee_login” table and if it exist then open some (page 34) page
in the current application.
Approach:
1: written authentication function as
CREATE OR REPLACE FUNCTION custom_auth (
p_username IN VARCHAR2,
p_password IN VARCHAR2
RETURN BOOLEAN
IS
l_password VARCHAR2 (4000);
l_stored_password VARCHAR2 (4000);
l_count NUMBER;
BEGIN
SELECT COUNT (*)
INTO l_count
FROM trx_employee_login
WHERE user_name LIKE p_username;
IF l_count > 0
THEN
SELECT PASSWORD
INTO l_stored_password
FROM trx_employee_login
WHERE user_name LIKE p_username;
IF l_password = l_stored_password
THEN
RETURN TRUE;
ELSE
RETURN FALSE;
END IF;
ELSE
RETURN FALSE;
END IF;
END;
2: created authentication scheme and entered
return custom_auth;
in authentication function.
3: same like I created Set Username cookie :
begin
owa_util.mime_header('text/html', FALSE);
owa_cookie.send(
name=>'LOGIN_USERNAME_COOKIE',
value=>lower(:P16_USERNAME));
exception when others then null;
end;
and other process to like 101 page
but I m not able to get the result showing always message “Invalid Login Credentials”
Please it will be great help if any one will help me. I m trying from the last 5 days but not able to do. I love to do myself first and if not possible then like to ask others. So please need help. Any other approach will be appreciated.
Thanks && Regards
Ravi

Thanks Scott very Much,
I changed but still I am not getting showing invalid credetial.
Any how I got some hope by you. Can you have look on this please again.I am very new in HTML so after six days trying I am bit tensed.Here is what I am doing
1: Created new login page Page 16.
2: In page rendering process I created a “Before Header process named Get cookie Name ” just like inbuilt login Page :
declare
v varchar2(255) := null;
c owa_cookie.cookie;
begin
c := owa_cookie.get('LOGIN_USERNAME_COOKIE');
:P16_USERNAME := c.vals(1);
exception when others then null;
end;
Incase of :P101_USERNAMR I change it as :P101_USERNAMR .
3: In page rendering I created “Clear Cache for all Items on Pages (PageID,PageID,PageID)”
process for page 16.
4: In Page processing I created a process named “Set Username Cookie” type After computation and Validation.
5: In page processing I ceated process Login just like page 101 and changed as
wwv_flow_custom_auth_std.login(
P_UNAME => v('P16_USERNAME'),
P_PASSWORD => :P16_PASSWORD,
P_SESSION_ID => v('APP_SESSION'),
P_FLOW_PAGE => :APP_ID||':1'
6: created one branch “On submit after processing to go to page 1 my welcome page”
7: Created Authorisation scheme function returning Boolean:
DECLARE
l_count NUMBER;
BEGIN
SELECT COUNT (*)
INTO l_count
FROM trx_employee_login
WHERE user_name = :p16_username AND PASSWORD = :p16_password;
IF l_count > 0
THEN
RETURN TRUE;
ELSE
:p16_username := NULL;
:p16_password := NULL;
RETURN FALSE;
END IF;
END;
8: I modified the function and make it UPPER case comparison as :
CREATE OR REPLACE FUNCTION custom_auth (
p_username IN VARCHAR2,
p_password IN VARCHAR2
RETURN BOOLEAN
IS
l_password VARCHAR2 (4000);
l_stored_password VARCHAR2 (4000);
l_count NUMBER;
BEGIN
-- First, check to see if the user is in the user table
SELECT COUNT (*)
INTO l_count
FROM trx_employee_login
WHERE UPPER (user_name) = UPPER (p_username);
IF l_count > 0
THEN
-- First, we fetch the stored hashed password & expire date
SELECT PASSWORD
INTO l_stored_password
FROM trx_employee_login
WHERE UPPER (user_name) = UPPER (p_username);
-- Finally, we compare them to see if they are the same and return
-- either TRUE or FALSE
IF l_password = l_stored_password
THEN
RETURN TRUE;
ELSE
RETURN FALSE;
END IF;
ELSE
RETURN FALSE;
END IF;
END;
In case of point 5 I mentioned how should I call my custom_auth function.
I m not getting if I am changing it as
custom_auth_ (
P_UNAME => v('P16_USERNAME'),
P_PASSWORD => :P16_PASSWORD,
P_SESSION_ID => v('APP_SESSION'),
P_FLOW_PAGE => :APP_ID||':1'
then showing error and if
custom_auth_ (
P_UNAME => v('P16_USERNAME'),
P_PASSWORD => :P16_PASSWORD
then wroung number of argument showing .
That’s what I am doing. I know I am doing some blunder but not getting where.
Can u please take a look and tell me what changes I should made to work this code.
Thanks && Regards.

User Account start up login

Hi, I've just bought a used and reformatted macbook pro and set up a user account for work. I've also now transferred my other user account for home from my imac. However whenever I start up the laptop it logs straight into my home account automatically by default meaning that whenever I want to use it for work on start up (which is 90% of the time) i have to start up, log out of my home account then log back into my work account, which whilst isn't a massive problem is particularly frustrating! Have looked around forums for solutions but not found anything, does anyone know how to change settings so that when the laptop starts up it defaults to the login screen so I can then select whichever account i want to go into?
Any help would be much appreciated!!

Open the Accounts pane of System Preferences and change the login options.
(51638)

Accessing an Unknown User account

Sorry if this is covered I could only find how to get rid on them and I need to access them not get rid of them.
I had a system crash with a blue screen. When it came back there was only a temp profile loading. In System Properties
under the tab Advanced button User Profiles
I have two Unknown Users listed with sizes listed.There is no folder for them under Users nor a listing in the system management in control panel. I cannot find these anywhere I could access them to pull files.
After some time I switched her to a local profile because of size limitations on the server and letting the profile rebuilt from the server copy I found that a large chunk of profile went missing. I believe it is in one of these two "Account Unknown"
users that show in the accounts list where you set to local accounts.
Problem I have is I don't have a profile folder to pull from. Yet I see this large profile listed.
My question is there any way I can get into that profile to retrieve those missing files? I have been reading posts about this for days and they are all what are these profiles and how do I make them go away. Well I need into them.
Hope you can help,
thank you,
Ric

I have tried a data recovery software. I have Data Rescue. It finds all sorts of deleted files. the problems are I have no idea if they are from the missing profile. reason being the profile was not deleted be someone it was dumped after a system crash and
was gone from the user folder after a reboot from a bluescreen. Now you can see them here and I really need to access them in the profile's structure as it was on the system IE the desktop and DOCUMENT folders and so on.
Now does someone know how to do that? I have a screen shot but I have to wait to show it. well the profile the unknown is listed as 2.3GB.
Also if the fix need to run in other OS I can make it work I'm good a few different ones.
Thank you anyone that can help.

Locking User account on Wrong Login Attempts

Version : 7.3.4.x.x
O/s : Digital Unix 4.0g
I want to lock a user account on unsuccessful number on logins (say 3). This is not in tis version of Oracle but is there any back-door to get this done apart from O/S. Authentication.

If you cannot upgrade to Oracle 8, then you might wish to consider auditing your database sessions.
There are a couple of steps to ensure this :-
i) in your database's init.ora file, look for the line "audit_trail = true"
If it's not there, then ask the DBA's to put it in and bounce the database.
ii) get a DBA to execute the SQL statement
AUDIT BY SESSION;
or
AUDIT BY SESSION WHENEVER UNSUCCESSFUL;
The first of these will audit all attempts to create a session on the database.
The first of these will audit all unsuccessful attempts to create a session on the database.
Audit records are then added to the view
SYS.DBA_AUDIT_SESSION
You could look in there for users with a certain number of unsuccessful logins.
And if you find any, then reset their password to "suspended000" or something that only you know. That way, they can't use their passwords any more and have to phone up to get it reset.
it's a roundabout way i know, but i hope it can be of some help
null

"Unknown User" account recovery, Please help

Hi,
Inadvertently i have been deleted an "unknown user" from the (System Properties-->User Profiles) this mistake deleted my "Desktop" and "My Document" files and other settings.
How can i resolve this problem or recover my files, i tried to use (System Restore) tool, but there is "uncompleted restore" message after computer restart.
Please tell me what to do, it's a critical problem for me :(
Best regards

As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as ‘Answered’ as the previous steps should be helpful for many similar scenarios.
If the issue still persists and you want to return to this question, please reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish.
In addition, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems.
Thanks!
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

User account appearing twice on external hdd

Hi,
For some reason one of my external hard drives is reporting back that there are 2 user accounts of the same name name? I've checked & repaired my permissions & also tried a few things I've seen on this forum, but with no luck. I know it's only a small thing & I should not worry about it, but it's bugging the **** out of me & I don't know how to get rid of it.
Here is a picture of what I mean. As you can see, the one on the right is ok, but the left one has this random account & if I untick 'Ignore ownership' it becomes an account called _Unknown
Any help on this would be appreciated & thanks in adavance

What filesystem is on that drive?

Lots of User Accounts Appeared?

Right having a dabble with Mac OSX Lion Server.
I have a mac mini set up as a server which I access remotely via a VPN.
I accessed it yesterday remotelty and noticed that I suddenly have 85 user accounts instead of the 3 I have set up? They have names like Dovecot Administration, CVMS, Daemon etc. Strange thing is when I access the server directly they don't show.
Any advice on to what has happend would be appreciated.
Thanks
Tony

Sorry, re-reading my last post, I see it should say... "and you can't log in to them".
I'm not sure why they whould show up when you access remotely. Maybe a filtering problem? These accounts really aren't meant to be presented to the user.
No, it's not a problem. They've always been there, doing their tasks in the background.

How do I get rid of an extra account on my login page for my iPad. It asking me to add an account which I do not know what is talking about.

this is for an iPad.

Hi,
Would you provide more information so that we can help you?
Are you using Adobe Reader for iOS on your iPad? How did you bring up the "login page"? Did you tap one of the buttons in the toolbar?
Is it asking you to create a new Adobe ID or Apple ID?
A screenshot would be helpful.
How to add a screenshot to a forum message from iPad/iPhone

An Invisible Account Appears On Login

When my login screen comes up I have two accounts my own (admin) and also another account, but when I go into Sytem Preferences I can't see this account... Someone told me it oculd be to do with Apache? I have no idea but I would love to know how to delete it if anyone can help me out?

In normal way, you don´t need the user root. When you have an process which need root access, you can use sudo process. This allowed you to execute root processes under your account with the admin password.
When you have enabled the user root, the option other is automatically in the login screen.

Unknown User account appears on login page

Similar Messages

Maybe you are looking for