Saturday, September 15, 2012 9:05 AM
Hi, in our AD there are several Domain admins and I would like to know if there is some log to find-out who has reset the password of a specific user.
Saturday, September 15, 2012 9:52 AMYou have to enable auditing and then you will get this information in DCs event log - it can be logged on different DCs so you have to gather events from all DCs to track all attempts. See this topic: http://technet.microsoft.com/en-us/library/cc737542(v=ws.10).aspx
- Marked As Answer by Markus VilcinskasMicrosoft Employee, Owner Sunday, March 17, 2013 10:23 AM
Saturday, September 15, 2012 12:01 PM
Thanks a lot for your answer.
The Audit for the account management was already active but I've found only the last 2 days of events in the Security, while for Application and System several months!
The retention days are not set. How is it possible? Do you know why?
Thx for your help!