Change Password Attempt: Target Account Name: %1 Target Domain: %2 Target Account ID: %3 Caller User Name: %4 Caller Domain: %5 Caller Logon ID: %6 Privileges: %7

Details
Product:	Windows Operating System
Event ID:	627
Source:	Security
Version:	5.2
Symbolic Name:	SE_AUDITID_USER_PWD_CHANGED
Message:	Change Password Attempt: Target Account Name: %1 Target Domain: %2 Target Account ID: %3 Caller User Name: %4 Caller Domain: %5 Caller Logon ID: %6 Privileges: %7

Explanation
An attempt was made to change the password of the target user account. The message indicates whether the attempt was successful. The person or process changing the password provided the old password. Because the user can change the password without logging on, the Caller User Name might be shown as “anonymous.”

User Action
If a single account has several password-change failures logged, it might be under a password-guessing attack. Verify that such an attack is not occurring. Otherwise, no user action is required. If a single account has several password-change attempts logged, the user might be trying to circumvent password-history policy.