3

I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect...

I did NOT change this password and I had to use a local admin account to reset the password to log back in.

The local event logs for "Security" show no mention of password change or set events - EVER. - There's over 233,000 logs so I assume I'm looking in the wrong place.

However the Powershell command: NET USER "loginid" | find /i "password last set" did return the date and time of me changing it a few minutes previously.

How can I see a full list of password changes? Or at least the one before mine?

2
  • If account auditing policies are in place, enabled and properly setup, then user-initiated password changes will be events 627 and 628. If auditing is not turned on, or the event log has been cleared, I think you're SOL. Oct 31, 2013 at 18:28
  • Am in the process of checking this as we speak, I have a feeling the guys who managed this server before me never bothered, I know I didn't set it up. Oct 31, 2013 at 18:29

2 Answers 2

3

Open the Event Viewer and filter for this event ID in the Security log:

Event ID 628: User Account password set

This event indicates the "caller" user reset the password of the "target" user. Password resets do not required knowledge of the current password. See event 627 for password changes by the user himself. This event will also be accompanied by event 642 showing that the Password Last Set date field was updated.

0

According to Ultimate Windows Security you should look for the following events in the Security event log:

  • 4723 The user changed their password
  • 4724 An account operator reset a password

Either of these will also trigger event 4738 A user account was changed.

If the password did not meet complexity requirements then the event is logged as an audit failure rather than an audit success.

If the user failed to enter their old password correctly then the above event does not get logged, however on a domain controller you will get an event 4771 because of the related Kerberos pre-authentication failure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .