InstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comTue, 07 Feb 2012 12:30:52 GMT20http://forum.ultimatewindowssecurity.com/Topic253-89-1.aspxDid this event occur by chance when you installed ASP.NET? Password change events are logged in conjunction with the creation of user accounts. Look for 624 for ASP.NET preceeding this event by a few seconds.Mon, 02 Nov 2009 08:40:49 GMTRandyFranklinSmithhttp://forum.ultimatewindowssecurity.com/Topic253-89-1.aspxHi,<DIV><FONT size=2></FONT> </DIV><DIV><SPAN class=618025807-02112009><FONT face=Verdana size=2>I have a small question and appreciate if any one can explain:</FONT></SPAN></DIV><DIV><SPAN class=618025807-02112009><FONT face=Verdana size=2></FONT></SPAN> </DIV><DIV><SPAN class=618025807-02112009><FONT face=Verdana size=2>In the EVENT log, 642 event is appeared for ASPNET account. and after investigation the only change I found is the last password change date. However the ASPNET is set with "user can't change password &amp; password is never expired", I am not sure how such event will accrue in this scenario.</FONT></SPAN></DIV><DIV><SPAN class=618025807-02112009></SPAN> </DIV><DIV><SPAN class=618025807-02112009>Thanks in advance </SPAN></DIV><DIV><SPAN class=618025807-02112009></SPAN> </DIV><DIV><SPAN class=618025807-02112009>Regards,</SPAN></DIV><DIV><SPAN class=618025807-02112009></SPAN> </DIV><DIV><SPAN class=618025807-02112009>Aleisa.</SPAN></DIV>Mon, 02 Nov 2009 03:05:24 GMTaleisa