New User Account

[TiredOfWindows]

Why is there a new user account generated during installation of updates? I set up my Windows XP Pro SP3 x86 computers so I would not have to sign on when starting. Now, since installing the updates I have to choose my user account to start Windows. The new user account was named ,net something. I can't remember the exact name because I deleted it. This has happened on the three computers That I have updated. I decided not to update any more until I find out what is causing this!

[kirb]

It’s the ASP.NET Machine Account, used when IIS (Internet Information Services, a web server) is installed. ASP is Active Server Pages, used to run code on the server to generate a page. It runs code under this account to isolate it from your documents, passwords, etc, so that web server code can only access the Windows, Program Files, and All Users folders. It protects you from potentially vulnerable code.

XP Pro comes with built in features that use IIS, being Remote Desktop and printer sharing. According to this poorly written KB article, it was added in .NET Framework 1.1 SP1, released alongside XP SP2, which significantly improved the OS’s security.

If you’re not using anything that needs a web server, you can uninstall IIS in Control Panel → Add or Remove Programs → Add/Remove Windows Components.

[TiredOfWindows]

I checked to see if IIS was installed in "Add/Remove Windows Components" and it was not.

I suspect that the User Account was installed by one of the .NET Framework updates but I don't know which one. I installed them all at once. If this is the problem and someone is able to determine which .NET update creates the account I can skip that update from now on.

Should IIS be installed before .NET Framework updates are installed? Was the User Account installed because IIS was not active?

[kirb]

As far as I can tell, .NET Framework 1.1 SP1 and later create the ASPNET user during installation. I guess it must do it even if you aren’t using IIS. Annoying, but you can delete it or just leave it there, it won’t affect anything. No need to enable IIS if you aren’t using it.

I’m speculating on this and haven’t confirmed, but I’m under the impression that account will be completely unused if you aren’t using IIS and ASP.NET. I also assume it has a randomly-generated password that only IIS knows about, or is configured to only be used via “impersonation” (switching context between users at a code level), and can’t be logged into.