Find changing administrator Password in log file

Hi
I have 1 PDC and 10 ADC in some branches, suddenly i saw my
administrator password was changed , my question is : how i can find
logs of this changing in event viewer? Thanks.

Hello mahmoudmga,

If you have enabled auditing for account management in the default domain
controllers policy or another GPO on that OU, you should find event id's
627 and 628:

http://www.ultimatewindowssecurity.c...px?EventID=627

http://www.ultimatewindowssecurity.c...px?EventID=628

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi
> I have 1 PDC and 10 ADC in some branches, suddenly i saw my
> administrator password was changed , my question is : how i can find
> logs of this changing in event viewer? Thanks.

Thanks Meinolf Weber.
I verify my event viewer and saw some of this event about changing
other users that i changed myself their passwords. but i didn't find
any event about this.
is there another way to find?
note that i was logged to my server with administrator 5 days ago and
my administrator password was changed yesterday.
Thanks a lot.

Hello mahmoudmga,

Did you check all DC's?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks Meinolf Weber.
> I verify my event viewer and saw some of this event about changing
> other users that i changed myself their passwords. but i didn't find
> any event about this.
> is there another way to find?
> note that i was logged to my server with administrator 5 days ago and
> my administrator password was changed yesterday.
> Thanks a lot.

On Jan 8, 12:27*am, Meinolf Weber [MVP-DS] <meiweb(nospam)@gmx.de>
wrote:
> Hello mahmoudmga,
>
> Did you check all DC's?
No. I checked only my PDC , so i will check all of my ADC and inform
you.

Hello mahmoudmga,

Yes, you have to check all, if someone else did the change on another site,
it should be logged there.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> On Jan 8, 12:27 am, Meinolf Weber [MVP-DS] <meiweb(nospam)@gmx.de>
> wrote:
>
>> Hello mahmoudmga,
>>
>> Did you check all DC's?
>>
> No. I checked only my PDC , so i will check all of my ADC and inform
> you.
>

Meinolf Weber [MVP-DS] wrote:
> Hello mahmoudmga,
>
> Yes, you have to check all, if someone else did the change on another
> site, it should be logged there.
>

An appropriate need for eventcombnt as opposed to searching through 11 DCs
everytime.

http://technet.microsoft.com/en-us/s.../cc297183.aspx

> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
>> On Jan 8, 12:27 am, Meinolf Weber [MVP-DS] <meiweb(nospam)@gmx.de>
>> wrote:
>>
>>> Hello mahmoudmga,
>>>
>>> Did you check all DC's?
>>>
>> No. I checked only my PDC , so i will check all of my ADC and inform
>> you.

--
/kj

Hello Meinolf Weber

> >> Did you check all DC's?

I checked all DC's but , i not found any trace of changing of
password.
note that when i was defined users , "user can change password" for
administrator user was enabled.
is there any way to find who was changed my administrator password?

Hello mahmoudmga,

The only way you have tried, logfiles from the DC's.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hello Meinolf Weber
>
>>>> Did you check all DC's?
>>>>
> I checked all DC's but , i not found any trace of changing of
> password.
> note that when i was defined users , "user can change password" for
> administrator user was enabled.
> is there any way to find who was changed my administrator password?