Re: Password Visibility

Your best bet is to enable auditing of account management on domain
controllers and then looking in the security logs of the domain controllers
for the account management event that would be generated when the user's
password was reset. Event Comb can greatly simplify the search process and
be sure to increase the size of the security logs substantially. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308471 --- Event
Comb
http://www.microsoft.com/technet/security/topics/auditingandmonitoring/securitymonitoring/default.mspx
--- The Security Monitoring and Attack Detection Planning Guide

"DavidW" <DavidW@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:7352D9C7-5F94-440B-B148-9293AE81CF0A@xxxxxxxxxxxxxxxx
> This may seem a very odd or simple question but is it possible for network
> administrators to see user network passwords? If the answer is yes, is
> there
> a way of auditing which administrator reset a user's password and when?
>
>
> Thanks


.

Relevant Pages

  • Re: Who disabled this account?
    ... Then enable auditing of account management in the Domain Controller Security ... Policy and look in the security logs of the domain controllers for Event ID 629. ...
    (microsoft.public.win2000.security)
  • Re: What should be audited on a DC
    ... Generally for domain controllers you want to audit at least account ... change, and account management. ... Be sure to increase the size of your security logs quite a bit ...
    (microsoft.public.win2000.security)
  • Re: What should be audited on a DC
    ... Generally for domain controllers you want to audit at least account ... change, and account management. ... Be sure to increase the size of your security logs quite a bit ...
    (microsoft.public.win2000.security)
  • Re: Automatically user lockout - big problem
    ... Check the security logs of the domain controllers to ... By default logging of account ... Comb can be used to scan domain computers for that account lockout event. ...
    (microsoft.public.windows.server.security)
  • Re: Prove someone logged in
    ... Auditing of account logon will have to be first enabled in Domain Controllers ... Security Policy and then you will have to look in the security logs of the domain ...
    (microsoft.public.win2000.security)