MARS 5.3 - Locate who/what is applying password reset on users account

[andrew-mccabe]

A users account within the AD is repeatedly being set to change password at next logon. How can I search for the cause in MARS or is this type of event not logged?

[mhellman]

I believe it will have event id 642 in Windows 2000 or 2003. Google that event id for more information.

[andrew-mccabe]

Thank you.

Can you explain how I can search for this event in MARS?

[mhellman]

For this example, username is BOB. open up notepad and type:

642Security

Where is the tab key. If you use a space, this won't work. Now ctrl-a to select all and ctrl-c to copy.

Now create a query.

query type = events ranked by time

time range = whenever you think this happened

keyword = AND BOB

submit.

[andrew-mccabe]

Thank you very much. Appreciated.