5

I recently setup a Simple AD Directory using the AWS Directory Service. When I browse the Directory using Active Directory Users and Computers from a Windows 2016 instance, I noticed a group named "GorillaBoyAdministrator" under Users.

Googling this name does not produce any results. The group is configured as a "Security Group - Global" and has no members, however it is a member of Domain Admins. Does anyone have any idea what this group is for?

At this point, I am inclined to delete the directory and recreate it, although that would entail a lot of rework, since I have a bunch of dependencies already setup.

UPDATE: According to AWS Support, this group is created for WorkDocs, see answer below.

8
  • 1
    I would shutdown this instance immediately, create an AMI (for backup and archiving). I would leave it down until the next step (as a minimum). I would create a new AWS Directory Service as a test platform and check if this group exists there. I am not aware of any AWS accounts that use that name. At the same time, I would be opening a support ticket with AWS. Sep 17, 2018 at 4:18
  • I don't know of any way to shutdown a Simple AD directory other than to delete it. There is only once instance connected, and I did shut it down right away. I guess it's time to open a support ticket with AWS. Thank you for the prompt response.
    – Jim Walker
    Sep 17, 2018 at 4:35
  • Sorry about that. I did not pay attention to the Simple AD part, I just saw Directory Services and responded. Security is one of my specialties and if you were hacked, waiting for an answer on SO could be hazardous. Sep 17, 2018 at 4:38
  • Absolutely. The only reason I am not terribly worried is because this AWS account does not have any production data on it. It's still concerning though, so on the line with AWS support right now.
    – Jim Walker
    Sep 17, 2018 at 4:42
  • Please post what you find out. I am very interested. Sep 17, 2018 at 4:45

1 Answer 1

6

Spoke with AWS Customer Support and apparently this group is created for AWS WorkDocs. So it is an internal AWS group. The support agent seemed to indicate that it's safe to delete if there are no plans to use WorkDocs with the directory in question. To quote AWS support:

"So the group "GorillaBoyAdministrator" is created for WorkDocs service."

6
  • I could not find GorillaBoyAdministrator anywhere in the AWS documentation and AWS is usually excellent and voluminous at documentation. Sep 17, 2018 at 5:04
  • I looked too, there is no mention whatsoever. In fact, if you google the term at the moment, this post is the only one that shows up.
    – Jim Walker
    Sep 17, 2018 at 5:09
  • 1
    What a stupid name for such a service account. Why not use WorkDocsSyncAdmin or something serious?
    – hargut
    Sep 17, 2018 at 5:48
  • 7
    This presumably happened during development - the dev team codenamed their project GorillaBoy, marketing hadn't yet decided on the final WorkDoc name, but dev had to give some name, so the went with GorillaBoyAdministrator. When this was discovered it was too late/too risky to change, so here we are. In Windows, this is also the reason for the weirdly-named c:\Windows\Panther folder.
    – Jonathan
    Sep 17, 2018 at 7:08
  • 2
    The trouble is that, while a competent hacker would know to name the group something plausible but inconspicuous (like, I don't know, WorkDocsSyncAdmin), you could still have a script kiddie making a funny, so an unprofessional name can't be used as some sort of reverse psychology proof that it wasn't a hacker, but bona fide developers stuck with an early name. Which is probably why those bona fide developers should plan ahead for how to make stuff not break for a rename on release day, lest you're left with an 800-pound GorillaBoy that sits wherever it wants. Sep 17, 2018 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .