Can I log on with the HelpAssistant account in Windows Server 2003 to administer a domain controller? This is the question that recently appeared in my inbox so I decided it was time for a quick refresher on the built-in user accounts and what they are there for.
In a Windows Server 2003 domain, three built-in user accounts are automatically created on each domain controller. The three default built-in user accounts include:

• Administrator
• Guest
• HelpAssistant

If you have worked with previous versions of Windows, you are more than likely familiar with the Administrator and Guest account. The HelpAssistant account is new in Windows Server 2003 but don’t let the name deceive you. It is not designed to be an account used to perform help desk and network support tasks.

Each of the different accounts has a different set of permissions. Logging on with the Administrator account gives you the right to administer the computer/domain. The Guest account is designed mainly for those users requiring occasional access to the network. For security purposes, this account is disabled by default. The HelpAssistant account is created automatically when a Remote Assistance session is requested and it has limited access to the computer.

You should keep a couple of points in mind in terms of the Administrator account. Since this account is granted full rights and privileges throughout the domain, you should use it cautiously. First of all, if you are the administrator consider creating a user account for yourself that you can use when performing non-administrative tasks. Also, for an added degree of security the Administrator account should be renamed. This makes it just that much harder for an unauthorized user to log on with the account if they do not know the name of it.

You may think that being the network administrator means that you should always be logged on with the Administrators account. However, this is a security no-no. What happens if you are constantly logged on with this account and mistakenly walk away from your workstation without locking it or logging off. It takes a very short amount of time for an unauthorized user or inexperienced user to make an irreversible change. May seem a little paranoid but in terms of security, better safe than sorry are words to live by. So instead of logging on with the Administrator account why not take advantage of the ‘Run As’ feature. This allows you to run programs under the Administrator (or another user account with administrative privileges) account when logged on as a user with less privileges.

There isn’t much too remember about the Guest and HelpAssistant accounts. The Guest account can be used to provide network access to those users who do not have a domain account. However, there are always dangers associated with allowing individuals without their own domain user accounts access to your domain. It is generally recommended that you leave the Guest account disabled. The HelpAssistant account is managed by the Remote Desktop Session Manager Service. If there are no pending remote assistance requests, the account is automatically deleted.