Windows Hidden User Creator - Printable Version

Windows Hidden User Creator - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.li/Forum-Hacking-Tools)
+--- Thread: Windows Hidden User Creator (/Thread-Windows-Hidden-User-Creator)

Windows Hidden User Creator - SourApples - 02-24-2022

Windows Hidden User Creator

Basic Information

This is a very basic batch file that creates a hidden user.

Download

RE: Windows Hidden User Creator - mothered - 02-24-2022

Quote:This is a very basic batch file that creates a hidden user.

So once It's hidden, can the change be reversed?

RE: Windows Hidden User Creator - DrKrieger - 02-27-2022

My 2 cents ...
Line 10 in the script seems to do the actual 'magic'
It adds the new user to a special list in the registry. So by removing the entry from the list the change can be reversed.

RE: Windows Hidden User Creator - ConcernedCitizen - 02-28-2022

Cool, you're adding a registry key to "persist" a hidden user.
See how fast any NGAV like Falcon stops this.

(02-24-2022, 09:43 AM)mothered Wrote: So once It's hidden, can the change be reversed?

Yes.

1. Win+R, "cmd.exe" `net user <user> /delete`
2. Then Win+R, "regedit" & remove the user entry in the registry: "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" outlined in the batch script.

RE: Windows Hidden User Creator - mothered - 02-28-2022

(02-28-2022, 07:03 AM)vittring Wrote: Yes.

1. Win+R, "cmd.exe" `net user <user> /delete`
2. Then Win+R, "regedit" & remove the user entry in the registry: "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" outlined in the batch script.

Nice one.

I assume a reboot will be required after removing the entry In the registry?

RE: Windows Hidden User Creator - radixtenshi - 03-01-2022

interesting to apply as part of a more complex chain of modifications.

RE: Windows Hidden User Creator - mothered - 03-02-2022

Further to my post above, I can confirm that a reboot will be required after the change Is reversed.