UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 628 - User Account password set

Event ID 628: Password reset by NTAUTHORITY\System

dago1010 — Mon, 12 Jul 2010 01:24:54 GMT

Hi,

on several Windows XP SP3 Clients we found event ID 628 together with event ID 642. The caller's username in both eventlog entries is computername$ (NTAUTHORITY\System).

We assume that some unauthoritzed users gained local admin rights on their machines and that those entries have something to do with it. What does it mean if the caller of an ID 628 is NTAuthority\System?

Kind regards,

Dago

Event ID 628 Password Reset Caller User Name not identified

GFord — Sun, 17 May 2009 18:56:08 GMT

Does anyone know why we are occassionally getting 628 Password Reset events where the Caller User Name: and Caller Domain are identified by only a dash '-'.

Caller User Name: - Caller Domain: -

I know in most of these cases the password had been set by a domain user since I can find a corresponding 642 Account Changed event where the Caller User Name is identified.

Thanks

GFord