Event ID 4723 An attempt was made to change an account's password. But shows a computer account$

KjstechO365 81 Reputation points
2021-01-04T20:55:27.173+00:00

We have log monitoring software and on 1/2/2021 at 4:01 PM an event came though email and here are the details with much of the information changed to more generic values

EventCode = 4723;
EventIdentifier = 4723;
Logfile = "Security";
SourceName = "Microsoft-Windows-Security-Auditing";
TimeGenerated = "20210102210006.000000-000";
TimeWritten = "20210102210006.000000-000";
Type = "Audit Success";
EventType = 4;
Category = 13824;
CategoryString = "User Account Management";
Message = "An attempt was made to change an account's password.

Subject:
Security ID: DOMAIN\VMWAREESXI$
Account Name: VMWAREESXI$
Account Domain: DOMAIN
Logon ID: 0xE24550C2

Target Account:
Security ID: DOMAIN\VMWAREESXI$
Account Name: VMWAREESXI$
Account Domain: DOMAIN

Additional Information:
Privileges -";
InsertionStrings = {"VMWAREESXI$", "DOMAIN", "S-1-5-21-57989841-448539723-XXXXXXXXX-8311", "S-1-5-21-57989841-448539723-XXXXXXXXX-8311", "VMWAREESXI$", "DOMAIN", "0xe24550c2", "-"};
};

Name: Security
Category: windows/events
event_id: 4723
msg_summary: An attempt was made to change an account's password.
src_user: VMWAREESXI$
dest_user: VMWAREESXI$
src_domain: DOMAIN
dest_domain: DOMAIN

My CIO wants to know what caused this alert. Why would an VMware ESXi server cause this at a time when the office was closed and nobody was working? My assumptions are that its just a normal part of the behind the scenes process that occurs to all domain joined objects, be it a windows machine or a vmware machine that is joined to AD for ease of logging into it.

Can you confirm?

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,645 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Fan Fan 15,341 Reputation points Microsoft Vendor
    2021-01-05T06:45:36.587+00:00

    Hi,

    Before going further, would you please check the events from the event viewer ?
    Did it show the same information?
    It seems like the computer password was changed .The machine account password change is initiated by the computer every 30 days by default. And machine account password changes are driven by the CLIENT itself(computer).
    When i tried to reset the computer's password from ADUC, the following event was recorded.

    53514-1052.jpg


  2. KjstechO365 81 Reputation points
    2021-01-08T15:24:27.53+00:00

    I think this may be an automated process? No person attempted to change any passwords. I guess computer accounts in AD do this on their own at predetermined intervals (like you said every 30 days by default)?


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.