I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect...
I did NOT change this password and I had to use a local admin account to reset the password to log back in.
The local event logs for "Security" show no mention of password change or set events - EVER. - There's over 233,000 logs so I assume I'm looking in the wrong place.
However the Powershell command: NET USER "loginid" | find /i "password last set"
did return the date and time of me changing it a few minutes previously.
How can I see a full list of password changes? Or at least the one before mine?