We had a weird problem occur on a production Windows 2003 R2 SP2 server which has about 50 local (the server is in a 2000 AD domain, but these accounts are local to the server) accounts defined. "User must change password at next logon" became activated for no good reason on all local accounts. Accounts with "User cannot change password" and "Password never expires" checked had those fields cleared at the same time.
The system event log had so many FTP login errors after this happened (the server is an FTP server and clients connect using automated processes) that by the time I looked at it it didn't go back far enough to cover the event. There does not appear to be anything relevant in the security and application event logs, which do go back far enough.
I'd appreciate hearing about anyone with a similar experience as well as any suggestions to investigate this further. I have at this point 2 guesses in mind:
1) The local SAM database file(s) were corrupted and then repaired by some sort of auto-repair/consistency checker by something like the SAM service. The repair process reset all accounts as described above. [Is there something that maintains/repairs the SAM and is what I'm suggesting possible?]
2) Approximately three and a half days before the accounts were all reset, I used a 3rd party tool from Winzero called Server Migrator to prepare a replacement server for the server in question. It definitely would have been accessing the SAM in order to pull accounts and passwords and copy them to the destination server. The big problem with this explanation is the time between using this tool and the event (customers were using the system during this in between time).
Any ideas of what could have happened will be appreciated as we have pressure from customers to explain the outage that resulted.