Article ID: 244057
Article Last Modified on 2/28/2007
APPLIES TO
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Datacenter Server
This article was previously published under Q244057
SYMPTOMS
The following event may be logged daily on a Windows 2000-based server with Terminal Services and auditing for successful account management enabled:
Source: Security
Category: Account Management
Type: Success
Event ID: 627
User: NT AUTHORITY\SYSTEM
Description: Change Password Attempt:
Target Account Name: TsInternetUser
Target Domain: DOMAIN
Target Account ID: MACHINE\TsInternetUser
Caller User Name: MACHINE$
Caller Domain: DOMAIN
Caller Logon ID: (0x0,0x3E7)
Privileges: -
CAUSE
The TsInternetUser account is used by the Terminal Services Internet Connector License. When Internet Connector Licensing is enabled, a Windows 2000-based server accepts 200 anonymous-only connections. Terminal Services clients are not prompted with a logon dialog box; they are logged on automatically with the TsInternetUser account. The success audit listed above is generated daily as the system changes the password used by the TsInternetUser account for security purposes. This is expected behavior on a server with Terminal Services Internet Connector Licensing enabled. Currently, this event is logged when Internet Connector Licensing is not enabled.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
Keywords: kbenv kberrmsg kbprb KB244057
