Announcement

Collapse
No announcement yet.

Does password change create log event?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Does password change create log event?

    Please help!

    If a user changes his password does that create a log event? I'm using Vista Home edition. A user's password was changed (without permission) and I am trying to pinpoint the date and time that it happened.

    I have tried using the event viewer and looking in the security log, however, I'm a newbie and don't know what to look for.

    If the event was recorded in a log that I can view, please tell me how I can find it (and what to look for).

    Thanks!

  • #2
    Re: Does password change create log event?

    You can try reviewing the security log, but I'm not sure if this is enabled by default on vista home.
    I'm even not sure if this is possible but I assume it will create the logging.

    However, A home edition is mentioned for home use?
    Marcel
    Technical Consultant
    Netherlands
    http://www.phetios.com
    http://blog.nessus.nl

    MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
    "No matter how secure, there is always the human factor."

    "Enjoy life today, tomorrow may never come."
    "If you're going through hell, keep going. ~Winston Churchill"

    Comment


    • #3
      Re: Does password change create log event?

      I can view the security log on Vista Home edition. I guess my real problem is that I don't know precisely what to look for. I don't see any events in the log that are clearly labeled as a "password change" or anything else that obvious.

      If anyone can tell me how a password change would appear in the log (and if the security log is the one I should be looking at) I would greatly appreciate it.

      Comment


      • #4
        Re: Does password change create log event?

        I don't believe password changes trigger an event. Have you actually tried changing your password and looking in the logs though?
        Gareth Howells

        BSc (Hons), MBCS, MCP, MCDST, ICCE

        Any advice is given in good faith and without warranty.

        Please give reputation points if somebody has helped you.

        "For by now I could have stretched out my hand and struck you and your people with a plague that would have wiped you off the Earth." (Exodus 9:15) - I could kill you with my thumb.

        "Everything that lives and moves will be food for you." (Genesis 9:3) - For every animal you don't eat, I'm going to eat three.

        Comment


        • #5
          Re: Does password change create log event?

          Password changing can blocked by policy. MS Home OSs often lack the tools to set this sort of policy but often if you know the right registry key the Home OSs will obey them. Either the Google or the OS's ADM/ADMX files should give you some keys to try

          From the ADM for win2k

          key="Software\Microsoft\Windows\CurrentVersion\Pol icies\System" valueName="DisableChangePassword"

          I presume it is under HKLU and takes the values 1 and 0 (1 to enable) but check it.

          Prevention is better than cure.
          Last edited by RMortimer; 10th October 2008, 11:18.

          Comment


          • #6
            Re: Does password change create log event?

            One important piece of information was omitted. If you are going to modify your Registry settings, it is CRITICAL that you make a backup of the Registry BEFORE messing with it. Thanks.
            1 1 was a racehorse.
            2 2 was 1 2.
            1 1 1 1 race 1 day,
            2 2 1 1 2

            Comment

            Working...
            X