Event ID 4724: password reset by another account
What Event ID 4724 (password reset by another account) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4724 means someone reset another account's password. Help desks do this every day, and attackers do it to take over accounts quickly. The question is always whether the reset matches a request.
The fields that matter
| Field | What it tells you |
|---|---|
| Subject | The account that performed the reset. |
| Target Account | The account whose password was reset. |
What is normal
Help desk staff resetting user passwords, and the sync account that writes back self-service password resets from Microsoft Entra ID.
When Event ID 4724 is suspicious
- Resets of admin, service or break-glass accounts.
- Many resets in a short time by one account.
- A reset followed by a logon to the target account from a new address.
- Resets performed by accounts that are not part of the help desk.
Common false positive: With Entra ID password writeback, self-service resets appear as the Entra Connect account (often named MSOL_...) resetting the user. Those are expected.
Find Event ID 4724 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4724
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4723: Password change attempt
- Event ID 4720: User account created
- Event ID 4738: User account changed
- Event ID 4624: Successful logon
FAQ
What is the difference between 4723 and 4724?
4723 is a user changing their own password with the old one. 4724 is a reset by someone else, which is the one to watch.
Should resets of krbtgt worry me?
Not if they are part of a planned rotation, done twice with time in between. An unplanned krbtgt reset needs an explanation.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.