event to see password changes

[rdgordon]

It was easy on nt server to see password changes in the event log; i don't remember the event but i remember it had something to do with anonymous.

Anyway is there an easy way to filter in W2K server event log to see password changes...

Thanks

 

[MitchCumstein]

First you have to set your Audit Policy to Audit Account Management (success and failure,) then it should show up as events 627 and 628 in the Security log. See:

http://www.itworld.com/nl/nt2k_sec/01082001/

http://www.microsoft.com/technet/tr...technet/security/issues/W2kCCSCG/W2kSCGcb.asp

 

[rdgordon]

thanks a lot