I have run into an issue where a single sites App Pool Identity password is being randomly changed to the password of a different App Pool Identity. The App pool ID username does not change just the password. The IIS logs and Event Viewer logs show only errors that are caused as a result of the change just not when the change actually occurred or what caused it. Is there a way I could monitor or log more complete changes to this specific site?
I rebuilt the site twice and the issue is still occurring so something/ some account is causing this to change and I need to figure out why. I usually go in and manually change it to the correct password but it will change again sometime throughout the day.
Some more info:
The site is on a VM using Windows Server 2012 R2 Standard. We are using IIS Version 8.0.9200. The App Pool Identity for all sites are using a unique Domain Accounts specific to the site.
We have 5 other similar sites built exactly the same that the issue does not occur for.
somesite1.com somesite2.com somesite3.com somesite4.com somesite5.com
Each site uses a unique App Pool ID and Password.
somedomain\SomeSite1WebService somedomain\SomeSite2WebService somedomain\SomeSite3WebService somedomain\SomeSite4WebService somedomain\SomeSite5WebService
The issue is when SomeSite4's App pool ID password changes to the password for somedomain\SomeSite5WebService.