3

I was taking a look into Computer Management->Users and found that SQL Server Express has created a lot of users for me.

Why? Is my system infected?

local users

The descriptions all say, "Local user account for execution of R scripts in SQL Server instance SQLEXPRESS".

6

Do you have installed the R- and Machine Learning services? According to the documentation below those are generated to run external scripts of those services in an isolated environment. So I would say they are normal if you install those components.

Those are part of the Advanced Services Variant of the SQL Express Edition.

From the documentation: Modify the user account pool for SQL Server machine learning

By default, the user account pool contains 20 user accounts. In most cases, 20 is more than adequate to support machine learning tasks, but you can change the number of accounts.

  • In a default instance, the individual accounts are named MSSQLSERVER01 through MSSQLSERVER20.
  • For a named instance, the individual accounts are named after the instance name: for example, MyInstanceName01 through MyInstanceName20.
2

Open Windows Security log and filter it for Event ID 4720: A user account was created.

You'll found who, when and with what attributes has created these users.

  • It got an empty list, opening event viewer, went into "Windows Logs" and "Security", then I right clicked "Security" and clicked "Filter Current Log"... and put 4720 in the textbox saying <All Event IDs>. – Anders Lindén Nov 9 '17 at 8:46
  • It is. It enabled by default, but if it is I bet it would say ‚TRUSTED INSTALLER‘ ,) – eckes Nov 9 '17 at 8:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.