Event ID 643 in Windows 2000 Server

[novellmel]

This morning, when I was looking through my Event Viewers for our Windows 2000 Servers, I found the following message:

Date: 4/28/03 Source: Security

Time: 3:55:15A Category: Account Management

Type: Success A Event ID: 643

Description: Domain Policy Changed: Password Policy Modified.


To me, it sounds like it's possible that someone got into our system at 3:55 AM this morning and changed a password policy. There are only 2 Network Administrators who are supposed to do that: Myself and a person I supervise. Neither or us were logged in at that time! Does anyone know what this message might mean?

 

[mattjurado]

Sounds like someone left their computer logged in, and perhaps a group policy refreshed. Or, maybe someone logged in last night to work, and a group policy was applied. This event is normal, and can occur when a group policy is applied. Is this a recurring event message?

Matt

http://www.eventid.net/display.asp?eventid=643&source=

 

[novellmel]

At first, I thought that this was not a recurring event. That was because I had sorted the log the wrong way! The user is always "NT AUTHORITY\SYSTEM" and the times are always odd (2:09 AM, 4:12 AM, etc). Based on the user name, this sounds like some sort of system function. At least, I hope that's what it is.

 

[mattjurado]

Yeah, sounds like a group policy being refreshed. I wouldn't worry about it.

Matt