Sign in
 
HomeLibraryWikiLearnGalleryDownloadsSupportForumsBlogs
Resources for IT Professionals >
> 
> 
> 
Is there a log to know who has reset the pwd in AD?

תשובה Is there a log to know who has reset the pwd in AD?

  • Saturday, September 15, 2012 9:05 AM
     
     
    Sign In to Vote
    0

    Hi, in our AD there are several Domain admins and I would like to know if there is some log to find-out who has reset the password of a specific user.

    Thx!

    Cam

     

All Replies

  • Saturday, September 15, 2012 9:52 AM
     
     Answered
    Sign In to Vote
    1
    You have to enable auditing and then you will get this information in DCs event log - it can be logged on different DCs so you have to gather events from all DCs to track all attempts. See this topic: http://technet.microsoft.com/en-us/library/cc737542(v=ws.10).aspx
     
  • Saturday, September 15, 2012 12:01 PM
     
     
    Sign In to Vote
    0

    Thanks a lot for your answer.

    The Audit for the account management was already active but I've found only the last 2 days of events in the Security, while for Application and System several months!

    The retention days are not set. How is it possible? Do you know why?

    Thx for your help!

    Cami