2

Has anyone seen this where a computer account appears to reset its password?

The password for user 'WEST\SQLCLUSTER$' was reset by 'WEST\SQLCLUSTER$' on 'DOMAINCONTROLLER.WEST.company.corp' at '04/23/10 20:47:41'
Event Type: Success Audit

Event Source: Security

Event Category: Account Management

Event ID: 628

Date: Friday, April 23, 2010

Time: 8:47 PM

User: WEST\SQLCLUSTER$

Computer: DOMAINCONTROLLER.WEST.company.corp

Description: User Account password set:

     Target Account Name:        SQLCLUSTER$

     Target Domain:      WEST

     Target Account ID:      WEST\SQLCLUSTER$

     Caller User Name:       SQLCLUSTER$

     Caller Domain:      WEST

     Caller Logon ID:        (0x0,0x7A518945)
David Yu
  • 1,032
  • 7
  • 14

1 Answers1

4

This is expected, normal, and good. Any computer running Windows 2000 or later will automatically change its computer account password every 30 days. This is a security mechanism. See this blog post for more info.

icky3000
  • 4,718
  • 1
  • 20
  • 15
  • I'm not sure that this is the case, I generated a report of event ID 628's over the past 2 months and I don't see any other computer accounts changing passwords. Only the computer listed in the example has done so and it's changed the password 3 or 4 times since the beginning of March. – David Yu May 03 '10 at 21:10