Sep 11 2018
09:45 AM
- last edited on
Nov 30 2021
10:07 AM
by
TechCommunityAP
Sep 11 2018
09:45 AM
- last edited on
Nov 30 2021
10:07 AM
by
TechCommunityAP
ATA has on activities Account password was changed. Is there a way to know what account password change password?
Sep 12 2018 03:36 PM
SolutionNo, This activity is calculated based on the password update time.
When we see the update time changes, we know the password changed, but we can't get the account that changed it.
Oct 02 2018 02:45 AM
Hi Eli
Thanks for the answer; could I clarify this please?
In ATA, it shows this activity for a user who is adamant they did not change their password. It happened at 8:16 yesterday (01/10/18) morning. However, this activity does not show to me when I search for that user; just to them when they search for themselves on ATA.
Can you please elaborate why this might occur; is it a false positive (they got their password wrong but this shows as the following activity to both me and him) or has someone tried to change his password but not him?
Thanks
Simon
Oct 02 2018 04:19 AM
I am not aware of false positives in logical activities, only on alerts.
logical activities represent facts.
Password changed means we so the password update time for this attribute changed.
It can happen if the user changed his own password or if it was changed for them,
but it's unrelated to trying to authenticate.
Also, trying to change a password without success should not trigger this password change activity.
Also, we don't have ACLs on logical activities, so I have no idea how come one of you can see the activity and one can't, unless you are using different filters or something like that.
I suggest to check the date in AD for that user using the Pwd-Last-Set attribute and see if it corresponds to what ATA is reporting.
https://docs.microsoft.com/en-us/windows/desktop/adschema/a-pwdlastset
Eli.
Sep 12 2018 03:36 PM
SolutionNo, This activity is calculated based on the password update time.
When we see the update time changes, we know the password changed, but we can't get the account that changed it.