Admin password phantom reset

[cragos1984]

Now then

 

I have a really strange problem where whenever i log into any of the servers using an account which is not the domain\administrator the password for the administrator gets reset. I am connecting through RDP but not sure that this should create any problems. Also haven't been able to find anyone online who's having anything even similar. I have checked the security logs etc but nothing is coming up as been even slightly odd. Its happened 3 or 4 times now and is obviously causing problems because all my scheduled tasks need editing every time. Any advice or thoughts would be great

 

Thanks

 

Craig

[Get2theChoppa]

erm...does anyone else have admin level access (enterprise admins)?

 

also have you installed admin pack on desktop pc's also?...to enable others to reset passwords?

[cragos1984]

erm...does anyone else have admin level access (enterprise admins)?

 

also have you installed admin pack on desktop pc's also?...to enable others to reset passwords?

 

The only people that have that sort of access are those who work in this office, its just strange that it seems to do it automatically whenever someone different logs into the server

[Get2theChoppa]

never come across this before, administrator password being reset randomly...and when you say it gets reset?... to what does it get reset to? (you dont have to disclose it here)... bt its quite bizarre...

[cragos1984]

never come across this before, administrator password being reset randomly...and when you say it gets reset?... to what does it get reset to? (you dont have to disclose it here)... bt its quite bizarre...

 

Yeah it really is, cant find anyone that's even had anything remotely similar. It just stops working, I have to go into AD logged in as myself and reset it

[Meldrew]

Its not just being locked out or something like that is it?

[cragos1984]

Its not just being locked out or something like that is it?

 

No the account hasn't been disabled. It seems to only happen when connecting through RDP though I think

[Meldrew]

Probably doesn't help at all, but does the password change happen immediately that logon happens, at the end of the logon process, or even at logoff?

[cragos1984]

Probably doesn't help at all, but does the password change happen immediately that logon happens, at the end of the logon process, or even at logoff?

 

Not 100% sure as ive only noticed it when ive gone to log back in as the admin later in the day

[cscott]

Group Policy preferences can be configured to do this - have you checked to make sure no one has created a preferences policy you don't know about?

[jc1875]

1) Check your domain controller logs for account changes. That should pinpoint the machines and account thats doing it as well as the time.

2) Then check the processes running on the target machine.

3) Run RSOP to see if theres a group policy applying to set the local admin password