Security Event ID 643

[Dennis Rice \(MVP\)]

I have a client getting repeated (every five minutes)
Event ID 643 with a Source of "Security" in the Security
Log Event viewer. Here is the event:

*******************************************

Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 643
Date: 9/11/2003
Time: 3:50:56 PM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Domain Policy Changed: Password Policy modified
Domain: Domain
Domain ID: Domain\
Caller User Name: SERVER$
Caller Domain: Domain
Caller Logon ID: (0x0,0x3E7)
Privileges: -
******************************************

I cannot figure out what is causing this event. Anyone
have ideas on getting rid of this? I'm uncomfortable not
knowing what is causing this.....

Thanks!

Dennis Rice (MVP)

 

[Dennis RIce \(MVP\)]

Windows 2000/SP3 Server by the way ..

 

[Al Smith]

try this link

http://www.eventid.net/display.asp?eventid=643&source=security

AL

 

[Steven L Umbach]

Domain controllers update their policy every five minutes, which leads me to
believe there is a problem with that. Are there any other error Event ID's
in the application or system log that repeat every five miniutes that may be
related? I would run netdiag and dcdiag /v on that domain controller looking
for failed tests. --- Steve

 

[Eric Fitzgerald [MSFT]]

It's not a problem, it's by design, we're improving the design ;-)

--
Eric Fitzgerald
Program Manager, Windows Auditing
Microsoft Corporation

The above message is provided "AS-IS" with no warranties, and confers no
rights.

 

[Steven Umbach]

Thanks for the explanation Eric - always appreciate it. --- Steve