Locked Out of a Windows VM After a Cloud-Admin Restart — Cloudbase-Init and the Password Nobody Set
A customer’s Windows VM came back from a routine restart with a new hostname, a dead network card and an Administrator password nobody knew. The customer blamed the cloud team. The cloud team blamed the customer. The Security log blamed SYSTEM. The real author was Cloudbase-Init, which re-ran its first-boot plugins and generated a random password with no key to encrypt it. Here is the log that proves it, the event IDs to match, and how to stop it happening again.