Password change for user ___VMware_Conv_SA___.

[marius1]

A cVenter server 5.x based on a Windows Server 2008 R2 server reports (late in the night) two events 4724 and 4738 related to a password change for user  ___VMware_Conv_SA___.

Is it a standard behavior or should I suspect an intrusion?

How can I manually reset the password for user ___VMware_Conv_SA___?

Regards

marius

[Dreckly]

Just passing through...

It looks like the VMware vCenter Converter Standalone Server service resets the password for ___VMware_Conv_SA___ each time the service starts.

Event ID 4738 & 4724 are both showing that the account's password was reset at the time the service is manually started.

(I'm having problems with the converter and searching all the logs / events it generates, hence finding this post...)