Event ID 4724 — Re-elect the password of an account

An attempt to re-enact the password of another account took place.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• User Support
• Administration AD
• Potentially abusive action

Verifications to be carried out

1. Identify Subject Account and Target Account
2. Check the existence of a support request
3. Control the following connections

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.