Skip to main content
AD Academy
Back to all events
4723SecurityAccountsINFOLast updated:

User changed own password

What it means

A password change made with knowledge of the old password — unlike 4724, an admin-driven reset.

First steps

  1. 1If Subject differs from Target it was not really self-service — investigate.
  2. 2A burst of 4723 at night is suspicious.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.