Re: Registry Question
From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: Sat, 5 Mar 2005 11:52:16 -0700
Sounds like the machine updated its domain account, likely
by changing the password as is done periodically if not shut
off. The account represents the machine's domain membership.
-- Roger Abell Microsoft MVP (Windows Security) MCSE (W2k3,W2k,Nt4) MCDBA "GX" <GX@DOMAIN.com> wrote in message news:%MjVd.123342$qB6.firstname.lastname@example.org... > Hello, > > I'm using Cisco Security Agent to monitor the boxes on my domain. Once of > the messages received was the following. Anyone knows why a wwindows box > will do these functions? > > The process 'C:\WINNT\system32\lsass.exe' (as user NT AUTHORITY\SYSTEM) > modified the registry key '\REGISTRY\MACHINE\SAM\SAM\Domains\Account' and > value 'F'. > > Thanks > > GX > >