Re: Registry Question

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 03/05/05

Next message: South Chic: "hacked account"
Previous message: tacoboy: "Re: Screensaver lockout does not work at all times"
In reply to: GX: "Registry Question"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Sat, 5 Mar 2005 11:52:16 -0700

Sounds like the machine updated its domain account, likely
by changing the password as is done periodically if not shut
off. The account represents the machine's domain membership.

-- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"GX" <GX@DOMAIN.com> wrote in message
news:%MjVd.123342$qB6.17938@tornado.tampabay.rr.com...
> Hello,
>
> I'm using Cisco Security Agent to monitor the boxes on my domain. Once of
> the messages received was the following. Anyone knows why a wwindows box
> will do these functions?
>
> The process 'C:\WINNT\system32\lsass.exe' (as user NT AUTHORITY\SYSTEM)
> modified the registry key '\REGISTRY\MACHINE\SAM\SAM\Domains\Account' and
> value 'F'.
>
> Thanks
>
> GX
>
>

Next message: South Chic: "hacked account"
Previous message: tacoboy: "Re: Screensaver lockout does not work at all times"
In reply to: GX: "Registry Question"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Registry Question
... I'm using Cisco Security Agent to monitor the boxes on my domain. ... Anyone knows why a wwindows box ...
(microsoft.public.win2000.security)
RE: Error: Failed to start monitoring changes - Framework 1.1
... Does it monitor other file types? ... I thought a request needed to be ... the problem isn't a permissions problem - the domain account has ... there's a slight lag in applying the permissions to new files or something. ...
(microsoft.public.dotnet.framework.aspnet)