The "internal"user is default to the user who log on to server locally,if this user doesn't belong to the dba group,the server will say "insufficient priveledge".
So,if you want to connect locally as sysdba:"connect sys/change_on_install as sysdba".
if remotely :"connect sys/@ as sysdba"