Re: Why are my workstations changing their passwords?

Tech-Archive recommends: Speed Up your PC by fixing your registry

Jorge, thanks for the response. What you say sounds reasonable enough, but
I'm seeing a burst of about 40 of the same messages for a single workstation
every 1-2 minutes. That's about 28,800 messages per day for each
workstation. All the same, all successful. They usually have the same time
stamp, although it can spread over 3-4 seconds. It seems a bit excessive to
me... And while I do see these messages occasionally for other computers,
it's mostly just the group I recently deployed. Users are able to work on
these machines without problems.

"Jorge de Almeida Pinto [MVP - DS]" wrote:

members of an AD domain initiate a password change right after they have
joined to the AD domain (if I remember that's within a day or so) and every
30 days past the last password change

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------

"David LaMora" <DavidLaMora@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:788BAB97-6715-4F1B-9557-3864722ABB95@xxxxxxxxxxxxxxxx
I recently deployed half a dozen XP Pro workstations, in a native Windows
Server 2003 domain. I'm now seeing success audit messages in the security
log on all domain controllers for Event 565. The accesses listed are:

READ_CONTROL
WritePreferences
ReadAccdount
SetPassword (without knowledge of old password)

These messages are showing up 30-40 times a second every 1-2 minutes, and
mostly (but not always) for the newly deployed workstations. I can't say
that I've spent a lot of time analyzing the security logs, but I haven't
noticed this before. Can someone shed a little light on this please?

Thanks in advance...


.

Relevant Pages

  • Re: How to show authenticated users against a DC
    ... # Jorge de Almeida Pinto # MVP Windows Server - Directory Services ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... * This posting is provided "AS IS" with no warranties and confers no rights! ... you'd have to look at the workstation audit ...
    (microsoft.public.windows.server.active_directory)
  • Re: How to show authenticated users against a DC
    ... you'd have to look at the workstation audit ... Outlook is one such app that comes to mind and the ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD Users and Computers snap-in
    ... # Jorge de Almeida Pinto # MVP Windows Server - Directory Services ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... an XP workstation without installing the entire AdminPak. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Default printer - Print Management
    ... individually at each workstation for each user ... # Jorge de Almeida Pinto # MVP Windows Server - Directory Services ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... management to push out a GPO to map printers upon computer startup. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Cannot browse to a domain controller across windows domains
    ... There are no security audit entrys success ... > or failure in the security logs when I try to log on...as though the ... > workstation which I am trying to browse the DC with has never contacted ... > to the domain controller of the outside domain. ...
    (microsoft.public.windows.server.networking)