Modified Registry Key

[NETCRAMMER]

The following registry key on one of my servers continues to come up as
modified:

HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\000001F4"|F"

I know this key is to reset the administrator password (which has not
changed) why do I continue to see this key
as modified?

Any help is appreciated.

TIA.

-NET

 

[Mike Rosado [MSFT]]

Hi -NET,

I'm by no means an expert in this subject matter related to SAM databases,
but since no one has responded to your posting then I'll try to assist you
to the best of my
ability. See if the following article addresses your concern.

173939 How to Identify the User Who Changed the Administrator Password
http://support.microsoft.com/?id=173939

--
Hope this helps,
Mike Rosado
Windows 2000 MCSE + MCDBA
Microsoft Enterprise Platform Support
Windows NT/2000/2003 Cluster Technologies

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
<http://www.microsoft.com/info/cpyright.htm>

-----Original Message-----