Where can I find the event ID for a password change?
If auditing is enabled, you should be able to see the information in the event log. Here are the event ID details: This posting is provided AS IS with no warranties, and confers no rights. Password change is carried out by the user – it seems that you are referring to password reset – correct?
How to check who reset the password for a particular user?
If the user fails to correctly enter his old password this event is not logged. Instead, for domain accounts, a 4771 is logged with kadmin/changepw as the service name. This event is logged both for local SAM accounts and domain accounts. You will also see event ID 4738 informing you of the same information.
What happens when an attempt is made to change a password?
The user attempted to change his/her own password . Subject and Target should always match. Don’t confuse this event with 4724. This event is logged as a failure if his new password fails to meet the password policy. If the user fails to correctly enter his old password this event is not logged.
What does a logon ID event ID mean?
Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session. Centrally manage WEC subscriptions. Free. An attempt was made to change an account’s password. Monitoring Active Directory for Security and Compliance: How Far Does the Native Audit Log Take You?
Where do I find the password change policy?
Auditing account management should be the easiest way for you to monitor the account password changing information. You may enable it under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. For the detailed information, please refer to the following Microsoft articles:
Where can I find the DCS event log?
If so, refer to http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/65703372-53a6-434a-a9fb-0ad03ab9132c/ in addition to the others you have to view all DCs eventlogs separate as the log can be written to each of the DCs.