3

I have the details about a user account when it was last modified (a password reset was done). But I would be interested to know who reset the password for this user. Is there any way I can find this out on windows 2012 active directory server.

  • 1
    What did you try? – 030 Apr 21 '15 at 16:35
  • 1
    I checked for a user account on the active directory by doing a right click on the user account in active directory and going to properties of the user account and checking the objects tab where I found information about the last modification details of the user account, but I still did not get details about who modified this account. I have tried checking it the event ids on windows log > security, but not very sure if I need to check this on my primary domain controller or if it is fine if I can check on any domain controller. – NMS Apr 21 '15 at 17:34
7

Enable Advanced auditing on the domain controllers for Account Management: Audit User Account Management

Note that if you enable Advanced auditing, you must not use legacy auditing.

Here are some of the events of interest:

4723: An attempt was made to change an account's password
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4723

The user attempted to change his/her own password. Subject and Target should always match. Don't confuse this event with 4724.

This event is logged as a failure if his new password fails to meet the password policy.

If the user fails to correctly enter his old password this event is not logged. Instead, for domain accounts, a 4771 is logged with kadmin/changepw as the service name.

This event is logged both for local SAM accounts and domain accounts.

You will also see event ID 4738 informing you of the same information.


4738: A user account was changed
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4738

The user identified by Subject: changed the user identified by Target Account:.

Attributes show some of the properties that were set at the time the account was changed.

This event is logged both for local SAM accounts and domain accounts.

Depending on what was changed you may see other User Account Management events specific to certain operations like password resets.


4724: An attempt was made to reset an accounts password
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4724

The Subject attempted to reset the password of the Target:

Don't confuse this event with 4723.

This event is logged as a failure if the new password fails to meet the password policy.

This event is logged both for local SAM accounts and domain accounts.

You will also see one or more event ID 4738s informing you of the same information.

  • 1
    Does this mean if I have not enabled the advance auditing option, then I will not be able to trace the details? – NMS Apr 21 '15 at 17:37
  • 1
    Yes, if you want a record of who did what, auditing needs to be enabled. – Greg Askew Apr 21 '15 at 17:44
0

You can enable auditing for Directory Service Changes. I don't know definitively if password resets show up there. They'll certainly be changed, but the auditing may only capture "normal" modification of attributes, meaning that the auditing may have the view that the change was performed under the authority of a DC, rather than in the context of a specific user or administrative user.

In this regard, password modification might be a special circumstance. For what it's worth...

https://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx http://blogs.technet.com/b/askpfeplat/archive/2012/04/22/who-moved-the-ad-cheese.aspx

Without auditing enabled, my guess is that even if you dig into the directory you'll only get information about what was done and at which domain controller but not which users's security context was responsible for the change.

  • As stated about can I not check for the event ids on the server? Will this not help me find out who modified the user account? – NMS Apr 21 '15 at 17:40

protected by Community Jun 4 '15 at 7:44

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.