Windows 2012 admin account was disabled: why?

Question

It is the second time I have problems with a Windows 2012 server. For unknown reasons it stopped working, console and remote desktop access was not possible, so it was restarted with a forced power off.

Security is not a concern (nobody took care about it) and there is the automatic logon with the local admin account. After the brutal restart it was noted the admin account was disabled.

In the event log I couldn't find anything useful to understand what happened. Above all I cannot find any reason why the account was automatically disabled. I thought it could be due to several logon attempts with a wrong password, but that security setting is disabled. What else can I check ?

The server is standalone and is not part of a domain

Thanks Filippo

Automatic logon with a local admin account on a server? WTF?!? — Massimo, Dec 03 '15 at 09:10
Some choices are beyond my control, so it is useless to talk about them. What I would like to know is why the admin account was disabled two times in the past two months. — Filippo, Dec 03 '15 at 15:11

score 0 · Answer 1 · answered Dec 03 '15 at 17:06

Auditing for account management events is disabled by default on all computers which are not domain controllers, so this apply to stand-alone servers too. If you enable it in the local security policy, account management events will show up in the security event log:

https://technet.microsoft.com/en-us/library/cc737542(v=ws.10).aspx

This will allow you to verify who or what is disabling the local admin account if/when this happens again.

Windows 2012 admin account was disabled: why?

1 Answers1