Skip to main content
AD Academy
Back to all events
4724Security (DC)AccountsWARNLast updated:

Password reset attempt by another user

What it means

An admin or helpdesk reset someone's password. Against a privileged account, investigate.

When it is normal and when it is suspicious

Normal: a helpdesk reset backed by a ticket. Suspicious: an admin account reset by someone outside the identity team.

First steps

  1. 1Match it to a service desk ticket.
  2. 2If the target is an admin account, treat it as compromise until proven otherwise.

Fields worth checking

FieldWhat to look at
Subject / TargetWho reset whom. Subject = Target means 4723, not 4724.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.