Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently installed Spiceworks and after I did the auto-discover it created a local profile on all the XP and Server 2003 machines. Is there a way to avoid this? What part of the auto discover actually needs to log in? Remote registry, remote perfmon and remote WMI can all be done without creating a local profile.

This seems like a huge security risk so I'd like to avoid it.

share|improve this question
So, how is this a "huge security risk", anyway? – Evan Anderson Dec 15 '09 at 2:55
If someone were to ever get a hold of this machine, either via a virus or physically through theft, having access to the usernames of valid users on the domain is risky. Especially considering these accounts that create profiles are domain accounts. Do you disagree? – user2015 Dec 15 '09 at 3:46
Yeah-- I'd tend to disagree. Set the password for the Spiceworks user to be complex and don't lose sleep over it. Windows maintains a list of the users who have logged-on and cached profiles in "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" anyway. – Evan Anderson Dec 18 '09 at 17:12
Totally disagree as well, this is how a domain works. If you are using security by obscurity you've already failed. Don't try to work against your authentication mechanisms, work with them. – Scott Alan Miller Jan 22 '10 at 18:40

I got a response from Spiceworks forums:

Hi Dan,

Sorry to be the bearer of bad news, but this is actually caused by reading registry settings through WMI and is a known issue with WMI. The registry reading in used mostly to get your installed software list. We are looking at using WS-MAN as a replacement to WMI, but it is too early to tell if this will suffer the same issue.

Probably no a great work around, but I suppose these profiles could be safely removed after a scan? Perhaps I could add a flag to do this automatically for you? Or, do you have a better idea?



share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.