Event ID 643

  • Thread starter Thread starter Paul Alllan
  • Start date Start date
P

Paul Alllan

Hi

Can anyone help, im getting event id 643 in the security
log when auditing AD. It happens every 5mins as expected
and its successfull. Looked it up and Microsoft seem to
point me at:

Domain Policy Changed: Password Policy
This might indicate an attacker is making it easier to
guess passwords on the system or to create a social
engineering attack.

I'm not changing the password policy.... so any help would
be good.

Thanks

Paul
 
| Hi
|
| Can anyone help, im getting event id 643 in the security
| log when auditing AD. It happens every 5mins as expected
| and its successfull. Looked it up and Microsoft seem to
| point me at:
|
| Domain Policy Changed: Password Policy
| This might indicate an attacker is making it easier to
| guess passwords on the system or to create a social
| engineering attack.
|
| I'm not changing the password policy.... so any help would
| be good.
|
| Thanks
|
| Paul
|
|

Paul,

A Windows 2000 client may generate the following event at periodic
intervals, even
though the password policy of the system has not been changed:
Event ID: 643
Type: Success Audit
Description: Domain Policy Changed:
Domain: %1 Domain ID: %2
Caller User Name: %3 Caller Domain: %4
Caller Logon ID: %5 Privileges: %6

Cause:
======
This issue is described in the following file BUG: WinSERaid2 26704

It details how "Password Policy Change" (event 643) does not distinguish
between
policy refresh and actual password policy change. Thus, each time that a
client or
server refreshes their local security policy (5 minutes for Active
Directory domain
clients or 16 hours for NT 4.0 domain clients), the audit event 643 occurs.

Resolution:
=========
This behavior is by design and is not indicating a problem with security or
auditing. This audit event can be safely ignored. In the event that there
is no
associated Event 1704 in the application event log for a 643 event, then
this may
very well be because of a password policy change.


Chad A. Lacy
Windows 2000 Directory Services

==================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Thanks for that

What do u mean by This issue is described in the following
file BUG: WinSERaid2 26704
as i cannot find it.

Cheers
 
Back
Top