Windows Event ID 4724 – Microsoft-Windows-Security-Auditing: User Account Password Reset by Administrator

Start by examining the specific details of the Event ID 4724 entry to understand the context and participants involved in the password reset.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4724 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4724 in the Event IDs field and click OK
5. Double-click on a 4724 event to view detailed information including:
   • Subject: The administrator who performed the reset
   • Target Account: The user whose password was reset
   • Logon ID: Session identifier for the administrative session
   • Caller Computer Name: Workstation where the reset was initiated

Use PowerShell to efficiently query and analyze Event ID 4724 entries across multiple systems or time ranges.

1. Open PowerShell as Administrator
2. Query recent password reset events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724; StartTime=$StartTime; EndTime=$EndTime}

4. Extract detailed information from event properties:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           Administrator = $Event.Event.EventData.Data[0].'#text'
           TargetUser = $Event.Event.EventData.Data[5].'#text'
           CallerComputer = $Event.Event.EventData.Data[11].'#text'
       }
   }

5. Query events from remote domain controllers:

   $DCs = Get-ADDomainController -Filter *
   foreach ($DC in $DCs) {
       Write-Host "Checking $($DC.Name)..."
       Get-WinEvent -ComputerName $DC.Name -FilterHashtable @{LogName='Security'; Id=4724} -MaxEvents 5
   }

Investigate Event ID 4724 alongside related security events to build a complete picture of administrative activities and potential security concerns.

1. Check for logon events (4624) from the same administrator around the time of password reset:

   $ResetTime = (Get-Date '2026-03-18 10:30:00')
   $TimeWindow = 30 # minutes
   $StartTime = $ResetTime.AddMinutes(-$TimeWindow)
   $EndTime = $ResetTime.AddMinutes($TimeWindow)
   
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4724; StartTime=$StartTime; EndTime=$EndTime} | Sort-Object TimeCreated

2. Look for account lockout events (4740) that might have preceded the password reset:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740,4724} -MaxEvents 20 | Sort-Object TimeCreated

3. Check for privilege escalation events (4672) indicating administrative rights usage:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672,4724} | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-1)} | Sort-Object TimeCreated

4. Examine failed logon attempts (4625) that might indicate the reason for password reset:

   $TargetUser = "john.doe"
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} | Where-Object {$_.Message -like "*$TargetUser*"} | Select-Object TimeCreated, Message

Implement comprehensive monitoring and alerting for Event ID 4724 to proactively detect unauthorized or suspicious password reset activities.

1. Enable detailed audit policy for account management:

   auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

2. Configure Group Policy for enhanced auditing:
   • Open Group Policy Management Console
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Enable Audit User Account Management for both Success and Failure
3. Create a PowerShell monitoring script:

   # Save as Monitor-PasswordResets.ps1
   $LastCheck = (Get-Date).AddMinutes(-5)
   Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4724" -Action {
       $Event = $Event.SourceEventArgs.NewEvent
       $Message = "Password reset detected: User $($Event.InsertionStrings[5]) by $($Event.InsertionStrings[0])"
       Write-EventLog -LogName Application -Source "Password Monitor" -EventId 1001 -Message $Message
       # Add email notification or SIEM integration here
   }

4. Set up Windows Event Forwarding to centralize logs:
   • Configure source computers with: winrm quickconfig
   • On collector server, run: wecutil cs subscription.xml
   • Create subscription XML targeting Event ID 4724
5. Implement log retention policies in registry:

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "MaxSize" -Value 0x6400000 # 100MB
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "Retention" -Value 0

Perform comprehensive forensic analysis of Event ID 4724 for security investigations and compliance reporting requirements.

1. Export security logs for offline analysis:

   $ExportPath = "C:\Forensics\SecurityLogs_$(Get-Date -Format 'yyyyMMdd').evtx"
   wevtutil epl Security $ExportPath

2. Generate detailed password reset reports:

   # Create comprehensive password reset report
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724} -MaxEvents 1000
   $Report = $Events | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       [PSCustomObject]@{
           Timestamp = $_.TimeCreated
           Administrator = $EventData[0].'#text'
           AdminDomain = $EventData[1].'#text'
           AdminLogonId = $EventData[2].'#text'
           TargetUser = $EventData[5].'#text'
           TargetDomain = $EventData[6].'#text'
           TargetSID = $EventData[4].'#text'
           CallerComputer = $EventData[11].'#text'
           CallerLogonId = $EventData[12].'#text'
       }
   }
   $Report | Export-Csv -Path "C:\Reports\PasswordResets_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

3. Analyze patterns and anomalies:

   # Identify administrators with high reset activity
   $Report | Group-Object Administrator | Sort-Object Count -Descending | Select-Object Name, Count
   
   # Find unusual reset times (outside business hours)
   $Report | Where-Object {$_.Timestamp.Hour -lt 8 -or $_.Timestamp.Hour -gt 18} | Format-Table
   
   # Detect bulk reset operations
   $Report | Group-Object @{Expression={$_.Timestamp.ToString("yyyy-MM-dd HH:mm")}} | Where-Object {$_.Count -gt 5}

4. Cross-reference with Active Directory changes:

   Import-Module ActiveDirectory
   $RecentResets = $Report | Where-Object {$_.Timestamp -gt (Get-Date).AddDays(-1)}
   foreach ($Reset in $RecentResets) {
       $User = Get-ADUser -Identity $Reset.TargetUser -Properties PasswordLastSet, LastLogonDate
       Write-Output "User: $($Reset.TargetUser), Password Reset: $($Reset.Timestamp), Last Logon: $($User.LastLogonDate)"
   }

5. Generate compliance documentation:

   # Create audit trail documentation
   $ComplianceReport = @"
   Password Reset Audit Report
   Generated: $(Get-Date)
   Total Events: $($Report.Count)
   Date Range: $($Report[0].Timestamp) to $($Report[-1].Timestamp)
   
   Top Administrators:
   $($Report | Group-Object Administrator | Sort-Object Count -Descending | Select-Object -First 5 | Format-Table -AutoSize | Out-String)
   
   After-Hours Activity:
   $($Report | Where-Object {$_.Timestamp.Hour -lt 8 -or $_.Timestamp.Hour -gt 18} | Format-Table | Out-String)
   "@
   $ComplianceReport | Out-File -FilePath "C:\Reports\ComplianceReport_$(Get-Date -Format 'yyyyMMdd').txt"