AD "Log On To..." Changes from All Computers to The Following Computers

I've enabled verbose logging on all AD changes and set the local audit policy to full... now I just need to wait until it happens again and see what they tell me.

I've got a little more info after 24 hours of verbose logging.

First of all, there is one other person who is having the same issues (is this you itiliti?) http://www.petri.co.il/forums/showthread.php?p=145064#post145064 and there is no solution posted.

here is what i've found:
1. the changes to the user accounts are happening every 8 hours (2.35am, 10.35am and 6.35pm)
2. i've checked all hidden Scheduled tasks - no tasks ran at these times.
3. Right before the changes start to take place there is a Directory Service log action
Source = ActiveDirectory_DomainService
Task Category = Directory Access
Event ID = 1174
General = Internal event: A privileged operation (rights required = 0x) was successfully performed on object CN=msWssgConfig,CN=System,DC=DOMAIN,DC=local.
4. the next log entry is from the same source
Internal event: A privileged operation (rights required = 0x) was successfully performed on object CN=msWssgActiveServers,CN=System,DC=DOMAIN,DC=local.
** this seems more than coincidental to me... that a AD change is make to an object called "ActiveServers" and then the user accounts userWorkstation attribute is changed to only servers**
5. then the changes start to happen to the user accounts:
Directory Services Log.
Source = ActiveDirectory_DomainService
Task Category = Directory Access
Event ID = 1174
General =Internal event: A privileged operation (rights required = 0x) was successfully performed on object S-1-5-21-3175168191-426460341-1888045963-1661.
Security Log.
Source = Microsoft Windows Security auditing
Task Category = User Account Management
Event ID = 4738
General =
A user account was changed.

Subject:
      Security ID:            SYSTEM
      Account Name:            LOCAL-SERVER$
      Account Domain:            DOMAIN
      Logon ID:            0xb721904

Target Account:
      Security ID:            DOMAIN\Username
      Account Name:            Username
      Account Domain:            DOMAIN

Changed Attributes:
      SAM Account Name:      -
      Display Name:            -
      User Principal Name:      -
      Home Directory:            -
      Home Drive:            -
      Script Path:            -
      Profile Path:            -
      User Workstations:      SERVER1, SERVER2, SERVER3, etc
      Password Last Set:      -
      Account Expires:            -
      Primary Group ID:      -
      AllowedToDelegateTo:      -
      Old UAC Value:            -
      New UAC Value:            -
      User Account Control:      -
      User Parameters:      -
      SID History:            -
      Logon Hours:            -

Additional Information:
      Privileges:            -

This runs through every user... I then have to change them back manually.
6. The PID that this runs under is 628 LSASS.EXE

Hope this info helps!

Yes, I am having the exact same issue on my EBS 2008 installation. Everything has been running fine for about 2 weeks, and now this happens every 6 hours. I have spent well over 10 hours researching this sissue. I am about to call M$... There are no running tasks, or anything like that . it is really annoying...need help...

yeah give MS a call... I'd appreciate hearing what they have to say

Hey itiliti.

Any word from MS? It's killing me!

In the mean time I've written a script that I'm going to schedule that will reverse this issue... luckily for me its happening at predictable times - but for you it will be a lot easier than manually doing it. Anyway, you just need to change the LDAP path to your users OU. (I take no responsibility if it doesn't work!)

Please post as soon as you hear from MS.

Thanks,
Matt

Const ADS_PROPERTY_CLEAR = 1
 
Set objOU = GetObject("LDAP://OU=Users OU, DC=DOMAIN, DC=Local")
objOU.Filter = Array("User")
 
For Each objItem in objOU
	objItem.PutEx ADS_PROPERTY_CLEAR, "userWorkstations", 0
	objItem.SetInfo
Next

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:

Thanks for the script. I thin it is hidden in one of those tasks that are running...

I will let you know what IO find out..

But you don't need to install CALs in 2008... there isn't even a way to install them. How did you?

http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/7e5e4c6c-acce-4f07-9eaf-b9b643672ba7/

I am using EBS. THere is definitely a place to install  the CALS on it...

I'm using EBS as well, but I've removed the EBS console and the System Centre Essentials... Where did you install them to?

Alrighty - itilit, did installing the CALs and assigning them work for you?

I've worked out how to install the CALs and assign them without using the EBS Administrator Console (I didn't actually remove it, but after I removed SCE & Forefront it just doesn't open)

Firstly you need to run

%programfiles%\Windows Essential Business Server\Bin\InstallLicenses.exe which will allow you to install CAL packs.
Then you need to assign them to each user - only way I can find is to use PS. (Use http://technet.microsoft.com/en-us/library/dd252607.aspx to install the PS Snap-in)
Next use Set-Cal in powershell to set the Cal per user.