event viewer change password question

[Damjan Dimitrov]

I have the following event in the security log:

Object Open:
Object Server: Security Account Manager
Object Type: SAM_USER
Object Name: DOMAINS\Account\Users\000003E8
New Handle ID: 662040
Operation ID: {0,4505788}
Process ID: 268
Primary User Name: ULTRANT$
Primary Domain: PROGRAMERI
Primary Logon ID: (0x0,0x3E7)
Client User Name: ULTRANT$
Client Domain: PROGRAMERI
Client Logon ID: (0x0,0x3E7)
Accesses ChangePassword (with knowledge of old password)
Privileges -

How can i find out the username of the user for which the password was
changed.

Thanks,Damjan.

 

[Steven L Umbach]

I beleive you would need to enable auditing of account management events and look for
Event ID 627. --- Steve