Event ID 642 in Windows 2000 Server Security Log

[cabetcove]

Hi everybody,

we often get event 642 in the event log and it states: "user Account of Administrator" has been changed.

caller user name: hostname$

We would like to find out who performs these changes but we can only see the hostname$ as caller user.

Does anyone have a logical explaination for this ?
Why can`t we see a username but only the hostname as originator ?

Thanks,
Thorsten

 

[itsp1965]

cabetcove, check the local and domain security policy entry for changing the administrator account.