MonitorWare Knowledge Base

I was browsing through my event log, as usual, looking for anything suspicious and found 2 instances reported by the account manager. One saying 'user account password set' the other sying 'user account changed'. The target account name was 'OFFICE$', with office being the name of one of my servers. Is this normal behaviour for windows NT 4, or is someone breaking in to my system?