azureblog.co.uk
← cd ~/events
// events/4723 · Accounts

Event ID 4723An attempt was made to change an account's password

A user tried to change their own password. A failure is logged if the new password breaks policy or, for local accounts, if the old password was wrong.

LogSecurity
SourceMicrosoft-Windows-Security-Auditing
AreaAccounts

What to check

For high-value accounts or accounts whose password should never change, alert on any 4723 for that target account.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4723 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

kql5 lines
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4723
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Related Accounts events

Search all 123 event IDs →

Sources