Event ID 4723: An attempt was made to change an account's password
Written when a user changes their own password (they had to supply the old one).
- Log
- Security
- Category
- Account management
Why it matters
- Mostly routine. A change soon after a suspicious logon can mean an attacker locking the real user out.
What to check
Check the timing against recent logons for the same account.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1098 Account Manipulation