HelpAssisstant_XXXXXX user created and delete events

Discussion in 'Security Software' started by Ron Williams, May 24, 2004.

  1. Ron Williams

    Ron Williams Guest

    Hi I have a windows 2003 server with all the security
    patches installed,
    however i am receiving events in the security log of the
    event viewer where a user is created and then deleted.
    The new accountname is HelpAssistant_634c49
    and the caller username is machinename$
    Could this server be compromised or is this a normal
    behavior caused by some service in windows 2003?

    Ron Williams, May 24, 2004
    1. Advertisements

  2. Hi Ron,

    HelpAssistant can be a legitimate account, it is used during remote
    assistance by the invited 'expert' when they connect to your computer during
    a remote assistance session. Its used by an administrator to log on and
    connect to a computer.

    More info here:

    If you don't use remote assistance it can be disabled via control panel,
    system, remote tab. Turn off the first option to allow remote assistance.
    Sandi - Microsoft MVP, May 24, 2004
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.