I have a customer that has server 2003 32 bit. This started about 1.5 year ago when suddenly the administrator password would not work. I use a cd that i boot from and reset the password. I then change the password to something new and give it to them. At that time I also made another admin account so I would always have access at any time. The administrator password will change and the admin account I made with default back to a standard users account. I can go back out and reset everything, change password and change the other account to have admin rights, but in a week or two it will change again and they will not be able to log onto the administrator account. I have changed policies that passwords never expire. Any advice would be appreciated.

Hello, looks like you used a Live CD to reset the password which is considered as an illegal way to proceed. If this computer is member of a domain, you can use a domain admin user to reset the local administrator password. If not and there is no other local admin account that can be used, then I think it will be better to restore your server from a backup that dates before the reset of the password. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified IT Professional: Enterprise Administrator

its not possible that windows administrator password changes automatically itself, could you please check the event viewer it will have the log if some one have changed the password in case.http://www.virmansec.com/blogs/skhairuddin

I have checked event viewer and its not being changed by a user. It is not on a domain. There are 5 users that connect remotely but they all have standard accounts. Using a live cd is the only way to reset it when it happens. I have actually taken the server off the network for a weekend and it still changed so it seems its not happening from oustside. What is strange is the account I make with admin rights always goes back to a standard user account when this happens.

rolling back to 1.5 years ago is not an option. I guess i can try a windows repair on the installation.

This all sounds very malware related. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]

Rans scans from symantec, malware bytes, spyware dr and 3-4 more. comes up clean

That may just means their definitions don't cover it. There's no native reason for this behavior. Been hanging around these and the old NNTP groups for more than ten years and afraid this is unheard of. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]

So, I see that you don't perform a backup for your server. Even if you detect malware program, you will not be able to uninstall it if you don't have admin privileges. If you don't have backups then I don't see a legal way to reset the admin password. I think it will be better to backup your documents, re-install the OS and then restore your documents from the backup. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified IT Professional: Enterprise Administrator