Re: domain administrator account password reset

If auditing is enabled (Account Management), it will show you that the
administrator password has been changed. Not much help since you know it
has been changed.

Look for event ids 627 and 628, setting a filter will lhelp.

http://www.windowsecurity.com/articles/Auditing-Users-Groups-Windows-Security-Log.html

--
Paul Bergson
MCT, MCSE, MCSA, Security+, BS CSi
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"Andrew Story" <andrewDOTstoryATjameswalkerDOTbiz> wrote in message
news:eNc3vBt4GHA.4352@xxxxxxxxxxxxxxxxxxxxxxx
An admin has done this, is there anyway to find out which account was
responsible for this?

Any info much appreciated (as always)




.

Relevant Pages

  • Re: Adding Computers to the Domain
    ... You would already have had to have auditing of account management in place to find ... --- Steve ... >> In the Domain Controller Security Policy enable auditing on account ...
    (microsoft.public.win2000.security)
  • Re: Domain admin users audit
    ... I don't receive any account management Event on Domain ... Controllers however i received all logon events, ... >Account Management auditing will cover the ...
    (microsoft.public.win2000.active_directory)
  • Re: Logging OU movement
    ... The answer to the original question is to use Auditing, ... Account Management is an easy to get things ... Set Auditing (ACLs) on the actually objects you wish to track using ...
    (microsoft.public.windows.server.active_directory)
  • Re: Info Date Account Windows 2000 Server
    ... profile folder as a general clue. ... Otherwise auditing of account management ... account management has been enabled an event will be recorded when a user ...
    (microsoft.public.windows.server.security)