TsInternetUser Password Is Changed Daily

• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Server

SYMPTOMS

The following event may be logged daily on a Windows 2000-based server with Terminal Services and auditing for successful account management enabled:

   Source:      Security
   Category:    Account Management
   Type:        Success
   Event ID:    627
   User:        NT AUTHORITY\SYSTEM
   Description: Change Password Attempt:
                Target Account Name:     TsInternetUser
                Target Domain:           DOMAIN
                Target Account ID:       MACHINE\TsInternetUser
                Caller User Name:        MACHINE$
                Caller Domain:           DOMAIN
                Caller Logon ID:         (0x0,0x3E7)
                Privileges:              -
 

CAUSE

The TsInternetUser account is used by the Terminal Services Internet Connector License. When Internet Connector Licensing is enabled, a Windows 2000-based server accepts 2,000 anonymous-only connections. Terminal Services clients are not prompted with a logon dialog box; they are logged on automatically with the TsInternetUser account. The success audit listed above is generated daily as the system changes the password used by the TsInternetUser account for security purposes. This is expected behavior on a server with Terminal Services Internet Connector Licensing enabled. Currently, this event is logged when Internet Connector Licensing is not enabled.

STATUS

Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article.

Additional query words:

Keywords : kbenv kberrmsg
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbprb