SOLVED Old password reversion: Does anyone understand what happened?

[Don Crew]

Yesterday my windows password was changed (reverted to a previous one) without me noticing.
I did not try to change my password, so I want to know how my password changed?
I found out when it changed using net user and I have accessed the log and noticed at the time of change an event 16 Kernel-General event occurred.
I have attached the screenshots below:

------------------------------
Additional information: I was on a video conference call that had just finished and I closed my laptop after finishing around the time the kernel event occurred.
I was concurrently working on a very basic C++ program in CodeBlocks a bit earlier that had crashed.

I tried to log in today again I tried to use my usual password but it didn't work.
So I tried my previous password and that worked but has left me very uneasy.
(I had changed my password at least 4 months ago and this is my personal computer with a non-expiring password ).
I just want to make this is not me being hacked, or that it is a bug or an issue that could affect another user before manually resetting my password to a new one.

Does anyone have any insight?
This is truly a weird error.

 

[Wolfie]

Did you run your AV app to be on the safe side?.

Don't know about PW changing but I must ask you first, what version of Win 10 do you have?:

https://www.windows10forums.com/thr...s-10-to-the-latest-version.13015/#post-107589

 

[Don Crew]

Did you run your AV app to be on the safe side?.

Don't know about PW changing but I must ask you first, what version of Win 10 do you have?:

https://www.windows10forums.com/thr...s-10-to-the-latest-version.13015/#post-107589

Running Avast was one of the first things I did.
I'm on Window 10 Home ver 1909.

 

[Trouble]

I haven't a clue but I can offer a wild guess....
Something occurred that prompt a diagnostic and repair event and somehow in that process a registry key or keys were replaced with older ones, presumed to be good from an earlier point in time System Restore point.

I just want to make this is not me being hacked,

I wouldn't expect a "hacker" to have knowledge of nor the kindness and generosity of replacing your current password with an older version.
ALTHOUGH this is starting to ring a very faint bell as something I seem to recall dating way-back several versions and builds ago
AND
I don't recall the findings, resolution or solution assuming there was one at the time

This is something one might expect if they had rolled back to an earlier version or build or actually recovered from a disk image backup but I expect that you would have mentioned something like that having happened.

 

[Don Crew]

I haven't a clue but I can offer a wild guess....
Something occurred that prompt a diagnostic and repair event and somehow in that process a registry key or keys were replaced with older ones, presumed to be good from an earlier point in time System Restore point.

I wouldn't expect a "hacker" to have knowledge of nor the kindness and generosity of replacing your current password with an older version.
ALTHOUGH this is starting to ring a very faint bell as something I seem to recall dating way-back several versions and builds ago
AND
I don't recall the findings, resolution or solution assuming there was one at the time

This is something one might expect if they had rolled back to an earlier version or build or actually recovered from a disk image backup but I expect that you would have mentioned something like that having happened.

I wouldn't expect that either, also your system restore point also seems to be ringing a similar bell in my head.
I would have thought it was the windows update if that wasn't two days ago with a successful login in between.
Also regularly I wouldn't think hackers either but I know a group that has tried to hack me in the past
(as training and in jest, since we were on the same cybersecurity hackathon team but they are still buttheads)
and I know I opened some ports lowered my comps regular level of resistance to internet hacking when I was in my video call.
But thanks!

 

[Wolfie]

Hi Don,

I found the following which might help you remember?:

https://www.tenforums.com/user-acco...anged-login-password-itself-while-asleep.html

 

[Don Crew]

I had checked that thread before when it first happened, it gave me the idea to use an older password instead of nuking my windows startup processes and putting in a new one with the old password built from a Linux environment. That being said maybe it was a fusion of issues that caused this problem... I'm gonna look into what the swap from Microsoft profile to local looks like in the log. Thanks for this idea!

 

[Wolfie]

Keep us posted please.

 

[Don Crew]

Keep us posted, please.

So that swap looks different so I think the closest to the solution of what happened was trouble.
Thanks to everyone though.

 

[Bill Shannon]

Yesterday my windows password was changed (reverted to a previous one) without me noticing.
I did not try to change my password, so I want to know how my password changed?
I found out when it changed using net user and I have accessed the log and noticed at the time of change an event 16 Kernel-General event occurred.
I have attached the screenshots below:

View attachment 11441

View attachment 11442



------------------------------
Additional information: I was on a video conference call that had just finished and I closed my laptop after finishing around the time the kernel event occurred.
I was concurrently working on a very basic C++ program in CodeBlocks a bit earlier that had crashed.

I tried to log in today again I tried to use my usual password but it didn't work.
So I tried my previous password and that worked but has left me very uneasy.
(I had changed my password at least 4 months ago and this is my personal computer with a non-expiring password ).
I just want to make this is not me being hacked, or that it is a bug or an issue that could affect another user before manually resetting my password to a new one.

Does anyone have any insight?
This is truly a weird error.

What might have happened is as you had an incident with windows when it rebooted it may have self fixed itself using an old file saved is some directory for the purpose of repairing corrupt files as that pasword is used on your computer its not required on a 3rd party website this might have happened I have never heard of it before I would change the password and also check log files for a keystroke program or the like just in case. Your password into your computer is local to your computer only. But I wouldn't change it until your sure you have no spyware. This could not happen to a website password if it did you wouldn't be able to log into the site with an old password.