Users being added in my non admin account in admin group

RickC said:

Look back over OP's previous posts. I'll take my hat off to you if you can find one single instance when the reported issue was eventually tracked down to 'external hacker activity'... you've even said so yourself.

Conversely, you have not seen this SYSTEM account activity yourself because it's the result of fiddling with the OS without realising the side-effects and subsequent automated OS responses.

If you're that interested, ask OP what did he/she disable specifically (and how) then try to duplicate the behaviour (in a VM).

I am asking what are they specifically disabling that would cause NTAUTHORITY to elevate into Adminstrator group, i already thought about it and i don't see any reason for this to occur. What i meant further in i don't know how to go about confirming the behavior.

Not sure where the hostility is coming from you keep talking like you have the answers without actually providing anything constructive to the OP.

I don't think there is anything in Services that warrants elevating a user account or even NTAUTHORITY if you turn it off. Anything that is critical to the OS cannot be disabled anyway and turning off remote services is not going to elevate an account, i have all the remote stuff disabled and that is the right logic if you don't require those services.

Malneb said:

I am asking what are they specifically disabling that would cause NTAUTHORITY to elevate into Adminstrator group, i already thought about it and i don't see any reason for this to occur. What i meant further in i don't know how to go about confirming the behavior.

Not sure where the hostility is coming from you keep talking like you have the answers without actually providing anything constructive to the OP.

I don't think there is anything in Services that warrants elevating a user account or even NTAUTHORITY if you turn it off. Anything that is critical to the OS cannot be disabled anyway and turning off remote services is not going to elevate an account, i have all the remote stuff disabled and that is the right logic if you don't require those services.

I agree with you 100%! Thanks for understanding. Im going to ask others in other forums, this cant be because of disabling a service, this is something else doing it.

Malneb said:

I am asking what are they specifically disabling that would cause NTAUTHORITY to elevate into Adminstrator group, i already thought about it and i don't see any reason for this to occur. What i meant further in i don't know how to go about confirming the behavior.

Not sure where the hostility is coming from you keep talking like you have the answers without actually providing anything constructive to the OP.

I don't think there is anything in Services that warrants elevating a user account or even NTAUTHORITY if you turn it off. Anything that is critical to the OS cannot be disabled anyway and turning off remote services is not going to elevate an account, i have all the remote stuff disabled and that is the right logic if you don't require those services.

Hey. I solved it! It was EaseUS ToDo Backup EBCClient.exe service that was the culprit, I disabled it and I don't get those things added automatically anymore.