Modified user profile?

[Gorstak]

Uhm, I've been using the builtin administrator account on my pc, and noticed something strange days after clean install. When I log out, there are two almost identical user profiles! Both are called administrator, however when I logon to the other one there is no sysprep window. Everything else is the same, desktop background, apps installed, however my programs settings are default, and not the way I have set them to be. This led me to beleive someone copied my account, modified it in some manner, possibly allowing remote access, then returned it to me to use. I don't Know what was originally in users folder, but I did find a folder called hidden, within roaming/Microsoft subfolder, and a file called rasphone.pbk. After googling, it seems this is a dial up phonebook used by rasphone.exe. I do have 2 phone lines in my apartment, and I don't normally use the other one. What am I dealing with here, and how do I solve the issue?

 

[Solaris17]

This literally correlated to what I told you last week, that you were in sysprep mode. Windows as far as it is technically concerned has never been setup OOBE has been bypassed. I literally go into detail about this in my sysadmin channel on YouTube, and my link in my sig regarding diagnostic drives.

That account is not made up. That account will not be the same. Any account on that unit built in or created will pull from the “default” hidden profile, which is generally modified during sysprep phase. That is what windows copies default data from.

 

[newtekie1]

They probably broke in through the workgroup!

 

[Gorstak]

I really feel like a zombie sometimes