Changes to a user account password made by anyone other than a legitimate IT administrator or an account owner may be a sign that the account had been hacked. Having gained access to the account, a malefactor is getting an ability to read, copy, delete and distribute sensitive data, which may result in significant data leaks.
4 Steps total
Step 1: Configure Audit Policy
Run GPMC.msc (url2open.com/gpmc) → open “Default Domain Policy” → Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Audit Policy:
Audit account management → Define → Success and Failure.
Step 2: Configure Event Log
Run GPMC.msc → open “Default Domain Policy” → Computer Configuration → Policies → Windows Settings → Security Settings → Event Log → Define:
Maximum security log size to 1gb
Retention method for security log to Overwrite events as needed
Step 3: Filter Event Log
Open Event viewer and search Security log for event id’s:
628/4724 – password reset attempt by administrator
627/4723 – password change attempt by user.
Da <https://community.spiceworks.com/how_to/117084-how-to-detect-password-changes-in-active-directory>