Forum

 2010-10-20 09:57:24.0 127.0.0.1 abc.123.com Windows Events (NIC) WINDOWS HOSTS 1402040100 User.Management.Password.Modification Security_4723_Microsoft-Windows-Security-Auditing 2010-10-20 09:56:41.0 Security Microsoft-Windows-Security-Auditing Success Audit   4723         An attempt was made to change an account s password.   0           0             0   abc.123.com NT AUTHORITY/ANONYMOUS LOGON ANONYMOUS LOGON   NT AUTHORITY 0xf039a976   juser FOOBAR     0 0.0 None                                 0             -       User Account Management             0   0         0             0.0 0                     An attempt was made to change an account s password.  Subject:  Security ID:  NT AUTHORITY/ANONYMOUS LOGON   Account Name:  ANONYMOUS LOGON   Account Domain:  NT AUTHORITY   Logon ID:  0xf039a976   Target Account:  Security ID:  FOOBAR/juser   Account Name:  juser   Account Domain:  FOOBAR   Additional Information:  Privileges  -
 

Here is what looks to be "normal"

2010-10-20 10:22:15.0 127.0.0.1 abc.123.com Windows Events (NIC) WINDOWS HOSTS 1402040100 User.Management.Password.Modification Security_4723_Microsoft-Windows-Security-Auditing 2010-10-20 10:21:15.0 Security Microsoft-Windows-Security-Auditing Success Audit   4723         An attempt was made to change an account s password.   0           0             0   abc.123.com FOOBAR/juser juser   FOOBAR 0xf0647f0b   juser FOOBAR     0 0.0 None                                 0             -       User Account Management             0   0         0             0.0 0                     An attempt was made to change an account s password.  Subject:  Security ID:  FOOBAR/juser   Account Name:  juser   Account Domain:  FOOBAR   Logon ID:  0xf0647f0b   Target Account:  Security ID:  FOOBAR/juser   Account Name:  juser   Account Domain:  FOOBAR   Additional Information:  Privileges 

The Subject Account in the first example is Anonymous Logon, but the Target Account is Juser which does not match.

The second example the Subject and Target match.

I have stoeckp same logs.

For one user, I have first Microsoft-Windows-Security-Auditing:4771 from Domain Controler A

The next log for the same user, from DC B, is Microsoft-Windows-Security-Auditing:4738. This log shows a Target Account as Anonymous Logon and the Source account is the user.

What does it mean ?

Thank you