Microsoft Exchange 2000 Creates Known Username and Password During Install.

 Reported November 16, 2000 by Microsoft

DESCRIPTION

Certain versions of Microsoft Exchange 2000, during the installation process, create a username and password that is known.  Under normal circumstances, this username and password can be only used to gain local user level access but on installations where Exchange is installed on a Domain Controller, Domain wide access could be obtained if one was to discover this username and password.

VENDOR RESPONSE

Microsoft has released a security bulletin and a tool to help combat this problem.

- The Tool can be downloaded from:

http://www.microsoft.com/Downloads/Release.asp?ReleaseID=25866

- Frequently Asked Questions: Microsoft Security Bulletin MS00-088,

http://www.microsoft.com/technet/security/bulletin/fq00-088.asp

- Microsoft Knowledge Base (KB) article Q278523,

http://www.microsoft.com/technet/support/kb.asp?ID=278523

CREDIT
Discovered by Microsoft.