event viewer change password

From: Damjan Dimitrov (damjan_at_ultra.com.mk)
Date: 10/17/03 

Date: Fri, 17 Oct 2003 15:16:24 +0200

I have the following event in the security log:

Object Open:
Object Server: Security Account Manager
Object Type: SAM_USER
Object Name: DOMAINS\Account\Users\000003E8
New Handle ID: 662040
Operation ID: {0,4505788}
Process ID: 268
Primary User Name: ULTRANT$
Primary Domain: PROGRAMERI
Primary Logon ID: (0x0,0x3E7)
Client User Name: ULTRANT$
Client Domain: PROGRAMERI
Client Logon ID: (0x0,0x3E7)
Accesses ChangePassword (with knowledge of old password)
Privileges -

How can i find out the username of the user for which the password was
changed.

Thanks,Damjan.

Relevant Pages

  • event viewer change password question
    ... Object Server: Security Account Manager ... Primary Logon ID: ... Client User Name: ULTRANT$ ... Accesses ChangePassword ...
    (microsoft.public.win2000.security)
  • Re: event viewer change password question
    ... I beleive you would need to enable auditing of account management events and look for ... > Primary Logon ID: ... > Client User Name: ULTRANT$ ... > Accesses ChangePassword ...
    (microsoft.public.win2000.security)
  • Re: Change in Security Account Manager
    ... You are seeing the System account on Server01 get handles to ... > Object Server: Security Account Manager ... > Primary Logon ID: ... > Client User Name: SERVER01$ ...
    (microsoft.public.win2000.security)
  • is my machine hacked?
    ... Event Type: Success Audit ... Caller User Name: GARNET$ ... Object Server: Security Account Manager ... Client User Name: GARNET$ ...
    (microsoft.public.win2000.security)
  • DC Demotion
    ... computer account SERVER2$ on the remote domain controller ... Event Category: Privilege Use ... Service: Security Account Manager ... Client User Name: Adminstrator ...
    (microsoft.public.windows.server.active_directory)