I've searched all over for an answer to this simple question. I use powershell frequently; by no means am I an expert though. I am looking for a powershell command/script to tell me what domain admin changed a user's password last.

  • Do you know the Event ID that signifies a password change? And is it being logged in your environment? – user2320464 Sep 16 '16 at 18:23

To be able to tell who made an password change, you need Active Directory Auditing enabled first. Only password changes made after you enable AD Auditing will be logged. Password changes are logged as Windows Event ID 4723 and 4724. You can use powershell to access the Windows Event 628 using the cmdlet Get-WinEvent.

The event message comes like this:

Target Account Name: %1
Target Domain: %2
Target Account ID: %3
Caller User Name: %4
Caller Domain: %5
Caller Logon ID: %6

To get the event with powershell, you can filter it like that:

Get-WinEvent -LogName Security -FilterHashtable @{id=628}

To enable Active Directory Auditing: https://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

For more info about the cmdlet Get-WinEvent: https://technet.microsoft.com/en-us/library/hh849682.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.