RabbieBurns Posted October 8, 2014 Posted October 8, 2014 Ive had an issue where a tech has changed the password of a user they shouldn't have, and I'm trying to track down who changed the password. Is there any method within AD to check the password change history?
SYNACK Posted October 8, 2014 Posted October 8, 2014 Not unless you have turned on auditing I the domain security policy beforehand and are up for a long journey through the dc event logs to try and find it as far as I know.
pete Posted October 8, 2014 Posted October 8, 2014 (edited) ^ That. Unless you're shipping audit logs somewhere else and parsing them for events. A quick-and-dirty workaround for the future would be to trigger on account/ad modification events and ship that event to another server acting as a logserver. Edited October 8, 2014 by pete
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now