Okay, so I know that ID 643 is Password Policy Modified

but how does this happen...

What process causes this to happen because I know myself, I didn't modify anything.

I also have a logon ID as (0x0, 0x3E7)