Return
-
Title
False positive "User password changed" and "User password changed by non-owner" events in Change Auditor -
Description
False positive "User password changed" and "User password changed by non-owner" events are recorded in the Change auditor Client when the "User must Change password at next logon option" in Active Directory Users and Computers is unchecked. -
Cause
When the "User must Change password at next logon option" goes from selected to unselected, the pwdLastSet is changed from "Never" to a timestamp. Change Auditor detects this as a password change. -
Resolution
WORKAROUND
None
STATUS
Waiting for fix in a future release of Change Auditor.
-
Defect ID
TF00589494