Hi pls exist rule which detect event 4724 and corresponding event 4723 ? after admin password reset change password by user ?
thanx
SCOM, audit collection services event 4724
Hi,
Do you want to know the difference between Event ID 4723 and 4724? If I am wrong, please correct me.
Generally speaking, 4723 is for password change by user himself/herself, while 4724 is for password change by others (administrators). For more details, you may rerfer to:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4723
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724
Regards
Alex
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
5 people are following this question.
