Thank you for your answer , I will insvestigate end test our tools to see if this changing the auth mode.

No one phisycally is changing it , as even when I restart the server myself it is doing it.

Could be one of our tools that run daily backup normally or...