Link to home
Create AccountLog in
Avatar of valuelabs97
valuelabs97Flag for India

asked on

How to know the when the local admin password changed

Hi

How can we find the when the local admin password has changed
Avatar of Paul Coffey
Paul Coffey

Turn security logging level up and look for events 627 and 628.  627 are password changes by the user and 628 is password changes by the administrator account.

You can also pull the password last set date out of AD.

http://www.rlmueller.net/PwdLastChanged.htm

ASKER CERTIFIED SOLUTION
Avatar of RobSampson
RobSampson
Flag of Australia image

Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
See answer