RePost: Security Log has sequence of failed attempts to change passwords

Never saw the original post:

> My security log on a Windows 2000 server (HOST in the example below)
> contains several suspicious entries all in a row where a user from the
> domain (DOMAIN\admin in the example below) attempts to change the password
> on every local account. This server is part of a NT4 domain and runs IIS
> and a MSDE database.
>
> Event Type: Failure Audit
>
> Event Source: Security
>
> Event Category: Account Management
>
> Event ID: 627
>
> Date: 9/23/2003
>
> Time: 4:14:30 PM
>
> User: Domain\admin
>
> Computer: HOST
>
> Description:
>
> Change Password Attempt:
>
> Target Account Name: IUSR_HOST
>
> Target Domain: HOST
>
> Target Account ID: HOST\IUSR_HOST
>
> Caller User Name: admin
>
> Caller Domain: Domain
>
> Caller Logon ID: (0x0,0x517DED)
>
> Privileges: -
>
>
> Any insight appreciated.
>
>

BG
Fri Sep 26 10:26:58 CDT 2003

This appears to be caused by running MBSA.


>-----Original Message-----
>Never saw the original post:
>
>> My security log on a Windows 2000 server (HOST in the
example below)
>> contains several suspicious entries all in a row where
a user from the
>> domain (DOMAIN\admin in the example below) attempts to
change the password
>> on every local account. This server is part of a NT4
domain and runs IIS
>> and a MSDE database.
>>
>> Event Type: Failure Audit
>>
>> Event Source: Security
>>
>> Event Category: Account Management
>>
>> Event ID: 627
>>
>> Date: 9/23/2003
>>
>> Time: 4:14:30 PM
>>
>> User: Domain\admin
>>
>> Computer: HOST
>>
>> Description:
>>
>> Change Password Attempt:
>>
>> Target Account Name: IUSR_HOST
>>
>> Target Domain: HOST
>>
>> Target Account ID: HOST\IUSR_HOST
>>
>> Caller User Name: admin
>>
>> Caller Domain: Domain
>>
>> Caller Logon ID: (0x0,0x517DED)
>>
>> Privileges: -
>>
>>
>> Any insight appreciated.
>>
>>
>
>
>.
>