machines (2) keep generating security alerts by changing admin account

machines (2) keep generating security alerts by changing admin account password approximately every 2 hours.  Event ID 642 and 628.
sadiojr1Asked:
Who is Participating?
 
jvuzCommented:
Does the events 627 and 628 give any idea who's changing the passwords?
0
 
jvuzCommented:
On a workstation or a server?
0
 
jvuzCommented:
Event id 627 and 628 should indicate who has changed the password.
0
 
sadiojr1Author Commented:
On servers
0
 
sadiojr1Author Commented:
partially resolved issue
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.