Re: Administrator Password changes
- From: "Jorge Silva" <jorgesilva_pt@xxxxxxxxxxx>
- Date: Wed, 20 Jun 2007 21:22:32 +0100
Hi
have a look
http://www.eventid.net/display.asp?eventid=642&eventno=226&source=Security&phase=1
--
I hope that the information above helps you.
Have a Nice day.
Jorge Silva
MCSE, MVP Directory Services
"Millette" <Millette@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:EC628285-E0C3-4B9D-B143-C5944EB6BDF1@xxxxxxxxxxxxxxxx
My network administrator password keeps getting altered somehow. The DC
does
not log any password change events. I do notice the following in the event
log.
Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 642
Date: 6/20/2007
Time: 11:10:33 AM
User: damin\mailserver$
Computer: DC
Description:
User Account Changed:
Target Account Name: Administrator
Target Domain: domain
Target Account ID: domain\administrator
Caller User Name: mailserver$
Caller Domain: domain
Caller Logon ID: (0x0,0x1652CD6)
Privileges: -
Changed Attributes:
Sam Account Name: -
Display Name: Administrator
User Principal Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: -
Account Expires: -
Primary Group ID: -
AllowedToDelegateTo: -
Old UAC Value: -
New UAC Value: -
User Account Control: -
User Parameters: -
Sid History: -
Logon Hours: -
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
--
Chris Millette
MCP/Network Administrator
Community Bank & Trust
.
- Prev by Date: Re: configuration of 2 remote sites
- Next by Date: Re: Domain Admins missing in GAL - AdminSDHolder?
- Previous by thread: Re: configuration of 2 remote sites
- Next by thread: Replacing a Domain Controller question
- Index(es):
Relevant Pages
|
