We have log monitoring software and on 1/2/2021 at 4:01 PM an event came though email and here are the details with much of the information changed to more generic values
EventCode = 4723;
EventIdentifier = 4723;
Logfile = "Security";
SourceName = "Microsoft-Windows-Security-Auditing";
TimeGenerated = "20210102210006.000000-000";
TimeWritten = "20210102210006.000000-000";
Type = "Audit Success";
EventType = 4;
Category = 13824;
CategoryString = "User Account Management";
Message = "An attempt was made to change an account's password.
Subject:
Security ID: DOMAIN\VMWAREESXI$
Account Name: VMWAREESXI$
Account Domain: DOMAIN
Logon ID: 0xE24550C2
Target Account:
Security ID: DOMAIN\VMWAREESXI$
Account Name: VMWAREESXI$
Account Domain: DOMAIN
Additional Information:
Privileges -";
InsertionStrings = {"VMWAREESXI$", "DOMAIN", "S-1-5-21-57989841-448539723-XXXXXXXXX-8311", "S-1-5-21-57989841-448539723-XXXXXXXXX-8311", "VMWAREESXI$", "DOMAIN", "0xe24550c2", "-"};
};
Name: Security
Category: windows/events
event_id: 4723
msg_summary: An attempt was made to change an account's password.
src_user: VMWAREESXI$
dest_user: VMWAREESXI$
src_domain: DOMAIN
dest_domain: DOMAIN
My CIO wants to know what caused this alert. Why would an VMware ESXi server cause this at a time when the office was closed and nobody was working? My assumptions are that its just a normal part of the behind the scenes process that occurs to all domain joined objects, be it a windows machine or a vmware machine that is joined to AD for ease of logging into it.
Can you confirm?