domain administrator account password reset

  • Thread starter Thread starter Andrew Story
  • Start date Start date
A

Andrew Story

An admin has done this, is there anyway to find out which account was
responsible for this?

Any info much appreciated (as always)
 
If auditing is enabled (Account Management), it will show you that the
administrator password has been changed. Not much help since you know it
has been changed.

Look for event ids 627 and 628, setting a filter will lhelp.

http://www.windowsecurity.com/articles/Auditing-Users-Groups-Windows-Security-Log.html

--
Paul Bergson
MCT, MCSE, MCSA, Security+, BS CSi
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
 
You must log in or register to reply here.

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Password Export error ADMT 3 1
Why was I just banned for no reason? 2
2000 Domain Admin Best Practices 2
net use question 2
AD restore questions 5
Help!! - Administrator Account problems. 2
Blank Passwords, Complex Requeirements and Problems... 5
Resetting local administrator password 7

Back
Top