Event ID 4724: An attempt was made to reset an account's password
Written when someone resets another account's password, without knowing the old one.
- Log
- Security
- Category
- Account management
Why it matters
- Resets of privileged or service accounts by unexpected admins are a common takeover step.
What to check
Compare Subject (who reset) with Target Account, and check whether the reset came from the help desk's normal accounts.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1098 Account Manipulation