UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 628 - User Account password set / Event ID 628: Password reset by NTAUTHORITY\System / Latest PostsInstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comThu, 17 May 2012 09:03:09 GMT20RE: Event ID 628: Password reset by NTAUTHORITY\Systemhttp://forum.ultimatewindowssecurity.com/Topic414-75-1.aspxI missed seeing this question unitl now. Whose password was reset? Check the Target Account NameSat, 28 Aug 2010 17:02:52 GMTRandyFranklinSmithEvent ID 628: Password reset by NTAUTHORITY\Systemhttp://forum.ultimatewindowssecurity.com/Topic414-75-1.aspxHi,<P>on several Windows XP SP3 Clients we found event ID 628 together with event ID 642. The caller's username in both eventlog entries is computername$ (NTAUTHORITY\System).</P><P>We assume that some unauthoritzed users gained local admin rights on their machines and that those entries have something to do with it. What does it mean if the caller of an ID 628 is NTAuthority\System?</P><P>Kind regards,</P><P>DagoMon, 12 Jul 2010 01:24:54 GMTdago1010