Please tell your experience: When/Why happened Event NETLOGON ID 5823 infrequently

Question

Please tell your experience related to Title issue.

On application server, Event log "LEVEL: Information Source: NETLOGON ID: 5823" happened infrequently (about Once per a month).

This server is a member of "ADomain" domain and Using one of domain user named "AAdmin" to logon to the server, set as a kicking user of tasks set on Task Scheduler, using as user of starting some application pool on IIS, and more...

I recognize that "NETLOGON ID 5823" means changing domain user's password.

But I and my colleague have not changed the password at all.

IT System using the server seem running as normal (anything trouble hasn't occur)

What is the cause or trigger of happening the Event Log?

Could you tell your experience to me?

Please excuse my poor English.

Answer 1

Hi, JUN NAKA

This is Chaboon.
Please let me know if the premise is different.

If NETLOGON ID 5823 means password change, that includes both user and computer accounts.

Computer account password changes occur automatically every 30 days. This is for security reasons.

Please see the article below for details.

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/machine-account-password-process/ba-p/396026

and

https://social.technet.microsoft.com/Forums/en-US/e16fcdda-8e5a-4b30-bbe0-d847bcb68b4e/dc-refuses-administrator-log-on?forum=winserverDS#:~:text=Then%20shortly%20after%205PM%20the,that%20changed%20the%20password.%20

Answer 2

In an Active Directory environment, every domain-joined computer has an automatically generated password that is not known to administrators but is securely managed by Active Directory. This computer account password, which is not human-readable, is used to establish a secure channel with domain controllers and is also utilized by the Key Distribution Center (KDC) to encrypt tickets.

Computer Account Password Change Behavior

By default, computer account passwords are designed to change automatically every 30 days. This periodic password change enhances security by reducing the risk of compromise.

It is normal to see Event ID 5823 in the event logs, which indicates that the computer account password was successfully updated. This event is part of the standard process and should not be cause for concern unless accompanied by errors.

Controlling the Password Change

The behavior of automatic password changes can be controlled using a Group Policy setting:

GPO Path:
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Domain member: Disable machine account password changes

• Default Setting: Disabled (machine account passwords are changed automatically).
  • If Enabled: Prevents automatic password changes for domain-joined computers.

Registry Setting for Password Change Behavior

The setting is also stored in the registry at the following location:

Registry Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

• Key Name: DisablePasswordChange
  • Value:

    - `0` (Default): Automatic password changes are enabled.
    
          - `1`: Automatic password changes are disabled.
    

Changing the Password Change Interval

The frequency of computer account password changes can be modified using a registry setting:

Registry Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Key Name: MaximumPasswordAge

  **Value:** This value is in days and determines the password change interval.
  
     **Default Value:** `30` (password changes occur every 30 days).
     
        **Example:** To set the password change interval to 60 days, update this value to `60`.
        
        **Steps to Update the Interval:**
        
           1. Open the Registry Editor (`regedit`).
           
              1. Navigate to the registry path: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters`.
              
                 1. Find or create the `MaximumPasswordAge` key as a `DWORD` value.
                 
                    1. Set the value to the desired interval in days (e.g., `60` for 60 days).
                    
                       1. Restart the computer for the changes to take effect.
                       

Recommendation

It is generally not recommended to disable or extend the password change interval beyond the default 30 days unless required for specific operational scenarios. Longer intervals can increase the risk of stale passwords being exploited by attackers.

Additional Notes

The computer password is stored locally in the LSA Secrets section of the registry and is synchronized with the domain controller. If there are synchronization issues, you may encounter errors such as Event ID 3210 ("Failed to authenticate with a domain controller").

If the secure channel between a computer and the domain controller is broken, it can often be resolved by re-establishing the computer's trust relationship with the domain using the Reset-ComputerMachinePassword PowerShell cmdlet or netdom resetpwd.