Share via

WDAGUtilityAccount Changed Properties Automatically

Anonymous
2023-12-14T19:18:57+00:00

We got an alert from our SIEM that the User must change password at next logon property changed from "No" to "Yes" on the WDAGUtilityAccount. There are only two of us with access to the server this happened on and neither of us made this change. Does anyone know why or how this would happen?

Windows Server Performance and maintenance System performance

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2023-12-15T02:09:51+00:00

    Hello

    Thank you for posting in Microsoft Community forum.

    The WDAGUtilityAccount is a system-managed account that is used for Windows Defender Application Guard (WDAG) scenarios. It’s not intended to be managed by users or administrators.

    The “User must change password at next logon” property is typically controlled by the pwdLastSet attribute in Active Directory. Setting this attribute to zero will force the user to change their password at the next logon.

    User Must Change Password at Next Logon (LDAP Provider) - Win32 apps | Microsoft Learn

    However, it’s unusual for this property to change without any administrative action. There could be a few reasons for this:

    Automated Policies: Check if there are any automated policies or scripts running that might have triggered this change.

    System Updates: Sometimes, system updates or patches might cause changes to system accounts.

    Potential Security Concerns: Unexpected changes could potentially indicate unauthorized access or other security concerns. It’s recommended to investigate these changes to ensure the security of your system.

    If you continue to see unexpected changes, it might be a good idea to reach out to your IT department for further assistance. Please remember to monitor your system regularly for any unusual activity.

    Best Regards,

    Wesley Li

    0 comments