2 Replies Latest reply on Oct 29, 2014 2:02 PM by relaxpreppy

    Nitro Alert and Report Needed - User Password Changed by Non-Owner

    planting_acorns

      I would like to build a Windows based Alert and Report which shows password changes by someone other than the account owner. The Event ID in-scope is:

      • 4723: An attempt was made to change an account's password

       

       

      Windows logs record the account performing the password change as the Subject Account Name which Nitro parses to the Source User field, and records the account receiving the password change as the Target Account Name which Nitro parses to the Destination User field.

       

      The Alert and Report must have the following filtering criteria:

      SignatureID = 43-263047230

      AND

      Source User != Destination User

       

       

      How do I accomplish the filtering criteria: Source User != Destination User