Hidden/Phantom user accounts, part 2

Thanks for reply, Bob. I was forced to start a new post because I couldn't post a reply to your original reply. Anyway:

1. I would have thought fdisk & format killed the "Dad" account too. So I logged in as Administrator after reinstalling Win2000 Workstation, and go to Control Panel-Users & Passwords. At this point, the list of users is only Administraor and Guest. Looks normal. But when I try to recreate another "Dad" user account, Win2000 told me there's ALREADY a user of that name created. I take another look at the user list, and there's still nothing other than the Admin & Guest account. Using Windows Explorer, I check out Documents and Settings to find a "Dad" account. There IS an entry: Cookies, Desktop, My Documents, etc. for the Dad account. Out of curiosity, I log off as administrator, and try to log in as Dad (which WAS an administrator account) since I still remember my password. I can log in! The only difference is that now, the former administrator Dad account is reduced to something less than Administrator: before I can access the Users and Passwords area, I must now provide Administrator's password.

Again, I am faced with the fact that I can log in as a user (although no longer as an administrator) using an old account name and password, but Win2000 Workstation doesn't list it in the Users list! I want to be able to delete this account or at least be able to see it - it is a potential security risk otherwise.

The only real workaround I have left untried is to re-fdisk, and then use a third party software to totally wipe the drive over with 1's & 0's, reformat using FAT32 (via WinME boot disk) or NTFS (using the booted Win2k CD) THEN reinstalling Win2k Workstation. I am aware that there is file recovery software which can recover data even from an fdisked and reformatted drive, primarily because FAT32 erasures only erase the file pointers, NOT the actual data stored which the file pointers are directed at.

2. About my other Win2k Workstation installation: a previous Win2k Workstation installation (using FAT32) went bad, because of my kids downloading all sorts of spyware and adware. So, I decided to bootup with my Win2k Workstation CD. It did, but the only options it gave me was to "repair" the previous installation or reformat the drive using NTFS. But I did not previously create the required repair/restore floppy disk which the repair fnction needed. At this point, I could have shut down, used an WinME boot disk, fdisked, and/or reformatted the C: drive with FAT 32, and THEN rebooting with Win2k Workstation. (NOTE: I am NOT asking to change from NTFS to FAT32. I am aware that you can only go FAT32 TO NTFS, and it's a one-way, one-time change for your files.) But because of the hassle of doing all that, and I wanted to experiment with NTFS' file security to restrict my kid's usage of game files, I decided to simply reformat using NTFS.

However, as I said earlier, using NTFS did NOT prevent the "phantom user account" phenomenon from occurring. On that computer I also still have a hidden account ("Philip" instead of "Dad") which I cannot see, and therefore, cannot delete nor alter. BTW, on both computers, ALL updates up to January 15, 2004 for Win2k were all downloaded and installed, using Windows Update.

As for my not using NTFS to it's potential: First, I've always liked FAT32 because it's the only file system which my OLD Ghost program can recognize to make backups. (I should get the newer Ghost, which handles NTFS volumes, but I'm wary of Symantec's product activation techniques.) Second, because I'm new to NTFS, I'm still learning just what it can do. Third, NTFS has NOT helped prevent the phantom/hidden user account situation, which is my true concern for this post.

I hope this explains my situation better. This seems like a big problem: being able to log in as user, yet not be seen in the user list? Clearly, a security issue or worse. I've been checking Microsoft's knowledge base without luck. Has anyone else who has reinstalled Win2k noticed this happening to their old user accounts?

Mike