To check password change history in Active Directory, enable Audit User Account Management through Group Policy and review the Security logs in Event Viewer on your domain controllers. Look for Event ID 4723, which records an attempt to change an account’s password, and Event ID 4724, which records an attempt to reset an account’s password.
These events can help you determine which account was affected, who initiated the password change or reset, and when the activity occurred. Active Directory does not provide a single built-in password change history report, so administrators typically use Event Viewer or PowerShell to find and review these events.
In this article, we’ll explain how to track password changes and resets using native Windows auditing and how to monitor these events using Lepide Active Directory Auditor.
Audit Password Changes and Resets with Native Auditing
Auditing password changes and resets in Active Directory natively requires two main steps: configuring group policy settings to enable auditing, and then finding the corresponding Event ID in Windows Event Viewer.
Prerequisites
Before you begin, ensure you have the following:
- Permissions: Domain Admin or delegated Group Policy management rights
- Supported Versions: Windows Server 2008 R2 or later
- Required Tools: Group Policy Management Console (GPMC), Event Viewer
Step 1: Configuring Group Policy Settings to Enable Auditing
Follow below steps:
- Open the Run dialog box, type gpmc.msc, and click OK to open the Group Policy Management Console.
- In the left pane, navigate to Forest → Domains → your domain → Domain Controllers.
- Create a new GPO or select an existing custom GPO linked to the Domain Controllers OU. It is generally preferable to use a dedicated GPO rather than modify the Default Domain Controllers Policy.
- Right-click the GPO and select Edit to open the Group Policy Management Editor.
- Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Account Management.
- In the right pane, double-click Audit User Account Management.
- Select Configure the following audit events.
- Select Success to audit successful password change and reset events. Select Failure as well if you want to audit failed password change and reset attempts.
- Click Apply, and then click OK.
- Allow Group Policy to refresh, or run gpupdate /force on the domain controllers if you want the updated policy to be applied immediately.
Step 2: Search for Password Change and Reset Event IDs 4723 and 4724
Once Auditing is enabled, perform the following steps in Event Viewer to view the events:
- Open Event Viewer and navigate to Windows Logs → Security.
- Search or filter the Security log for Event ID 4723. This event records an attempt to change an account’s password.
Under Subject, you can see the account that initiated the password change attempt.
Under Target Account, you can see the account whose password change was requested.
Event Details for a User-Initiated Password Change Attempt (Event ID 4723) - Search or filter the Security log for Event ID 4724. This event records an attempt to reset an account’s password.
Under Subject, you can identify the account that initiated the password reset attempt.
Event Details for a Password Reset Attempt (Event ID 4724) Under Target Account, you can identify the account whose password reset was requested.
Target Account Details for a Password Reset Attempt (Event ID 4724)
Alternative Method: Query Password Events with PowerShell
You can also use PowerShell to retrieve password change and reset events from the Security log.
Retrieve password change events (Event ID 4723):
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4723} | Format-ListRetrieve password reset events (Event ID 4724):
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4724} | Format-ListRetrieve password change and reset events from the last 7 days:
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4723,4724; StartTime=(Get-Date).AddDays(-7)}Export password change and reset events from the last 7 days to a CSV file:
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4723,4724; StartTime=(Get-Date).AddDays(-7)} |
Export-Csv -Path "PasswordChanges.csv" -NoTypeInformationHow Lepide Active Directory Auditor Tracks Password Changes and Resets
As you can see from the above, tracking password changes and resets using the Event Viewer is a bit of a pain. In general, event logs are noisy – and administrators can spend hours trawling through false positives or irrelevant information to find what they are looking for. Event logs also lack critical context.
Want a quicker, more comfortable, and straightforward means of determining when passwords are changed for user accounts? Lepide Active Directory Auditor can provide you with this level of in-depth visibility through real-time alerts and reports that help you overcome the limitations of native auditing. The screenshot given below shows the “Password Change Report.”
You can select an event and extract detailed information in a matter of clicks; including answers to critical information – object name, object path, email address, password last set, days since password set, etc.
Lepide also provides a simple report for tracking password resets in Active Directory. The screenshot given below shows the “User password reset” report. Simply select an event to extract in-depth information, including answers to the critical who, what, where and when questions, which enables you to spot suspicious activities.
Native Auditing vs. Lepide Active Directory Auditor
Conclusion
After configuring auditing, you can carefully monitor password changes and password resets in real-time, including users with soon-to-expire passwords, users with already expired passwords, users whose passwords never expire, accounts with passwords due to be changed at next logon and recent logon failures.
Frequently Asked Questions
Event ID 4723 is logged when a user changes their own password, while Event ID 4724 is logged when an administrator or another user resets someone else’s password.
By default, the Security event log retains events until it reaches its maximum size (typically 20 MB), then overwrites the oldest events. You can configure retention settings in Event Viewer properties or through Group Policy.
Yes. When you locate Event ID 4724 in the Security log, the “Subject” section shows the administrator who performed the reset, and the “Target Account” section shows whose password was reset.