Is there a way i can know that how many times password for a particular
active directory user was reset during last month and who did it?

appreciate your help!


Regards,

You will need to enable auditing (Account Management) on all of your domain
controllers) - and search for the corresponding event (Windows 2000 Server
and Windows Server 2003 - event ID 628, Windows Server 2008, 4724)

hth
Marcin

"Shehzad shaukat" <Shehzadshaukat@discussions.microsoft.com> wrote in
message news:BF8C0414-A8BD-416D-88C4-3D417804A9FB@microsoft.com...

Quote:

Is there a way i can know that how many times password for a particular active directory user was reset during last month and who did it? appreciate your help! Regards,

Hello Shehzad,

To see how often the password was changed i think not. You can try to use
ldp.exe to search for the user properties stored in the AD database. See
here how to use it:
http://technet.microsoft.com/en-us/library/cc772839.aspx

You have to enable auditing in a GPO in Domain controllers OU for account
management to see who changed it. Event ID 628 should logged with the info's.
In 2008 Event ID 4724.

Also you can install the acctinfo.dll from the account lockout tools:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

Either extract and copy only the acctinfo.dll to %systemroot%\system32 and
register it from the run line with "regsvr32 acctinfo.dll". If you now open
ADUC you have an additional tab in the user properties "Additional Account
Info". Or you can insntall the complete account lockout tools without registering.

See here about the complete tools features:
http://technet.microsoft.com/en-us/library/cc738772.aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

Quote:

Is there a way i can know that how many times password for a particular active directory user was reset during last month and who did it? appreciate your help! Regards,

Hello Shehzad,
Even if auditing is enabled you may not be able to learn this, since dc's
become so busy and if the log isn't large enough to hold all the events it
will simply roll off. So you need to manege your logs as well as audit them
to find out information such as this.


--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4


http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This posting
is provided "AS IS" with no warranties, and confers no rights.

Quote:

Is there a way i can know that how many times password for a particular active directory user was reset during last month and who did it? appreciate your help! Regards,

you would need to turn on auditing of such action

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------

"Shehzad shaukat" <Shehzadshaukat@discussions.microsoft.com> wrote in
message news:BF8C0414-A8BD-416D-88C4-3D417804A9FB@microsoft.com...

Quote:

Is there a way i can know that how many times password for a particular active directory user was reset during last month and who did it? appreciate your help! Regards,