Security

Ask something
Discussion Locked

ChangePasswordAttempt in W2K SecurityLog

0 helpful
4 replies

by cemtex

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello everybody,

I'm running W2KPro SP4 on a standalone stantion for internet access and testing/learning purposes; and I recently installed MBSA (Microsoft Baseline Security Analyzer v1.1.1) and ran a full scan, and had to download some missing hotfixes.
Anyways, few days later I was going through my Security Logs and found tens of password-failure attempts, a typical example is:
--------------------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Account Management
Event ID: 627
Date: 24/10/2003
Time: 02:08:16 AM
User: MyMachine\XZZ
Computer: MyMachine
Description:
Change Password Attempt:
Target Account Name: Administrator
Target Domain: MyMachine
Target Account ID: MyMachine\Administrator
Caller User Name: XZZ
Caller Domain: MyMachine
Caller Logon ID: (0x0,0xC991)
Privileges: -
--------------------------------------------------------------------
Whats intresting is that I'm not using the default "Administrator" name for the real admin user, yet most of the attempts were made to the real admin account (XZZ, in my example).
Could it be a hacking activity, or simply the MBSA software I installed was doing some routine checks?

Thanks,

4 replies

by kumaran

There could be an appliction file [possibly a sptware] that generates this error message. Try to put a personal Firewall to the system and check if the Event ID reappears. Also, try to use Ad-aware to delete all the spyware files that you would have contracted through downloads from the internet.

Ad-Aware can be downloaded from,

http://www.lavasoft.de/software/adaware/

by cemtex

Thanks Kumaran..
I'm using Norton Internet Security firewall, and have spent a great deal of time to carefully configure each and every rule. As for the ad-aware software u mentioned, i'm pretty sure that recording a user's surfing habits is one thing and changing the security logs of a win2k-sp4 secured system is a hell of another BIG issue!
I'ma download the adaware thingie anyways, and will let u know.

by Former member

Probably a service account still using the Administrator user...

by cemtex

Thanks for the answer; but I only have my real admin account (using another name), a disabled guest account and one power user account. No special accounts for services or development purposes.
Any suggestions for further investigation I might be able to do?

This discussion is closed to new replies.