> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/monitor-password-reset.md).

# Monitor a Password Reset

This lab shows how Windows records an administrator resetting another user's password.

## Objective

Generate and review Event ID `4724`, which records an attempt to reset an account password.

## Reset the Test User Password

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Locate `tempuser01`.
3. Right-click the account.
4. Select **Reset Password**.
5. Enter a new lab-only password.
6. Confirm the reset.

Do not use a personal or production password.

## Find the Event

Open:

**Event Viewer > Windows Logs > Security**

Filter for:

```
4724
```

Open the newest matching event.

## What to Review

Identify:

* the account that performed the reset
* the account whose password was reset
* the domain
* the event time

The event does not reveal the password. Security logs record the action and related account information, not the secret itself.

## Important Distinction

A password reset performed by an administrator is different from a normal password change performed by the user. This lab focuses on the administrative reset action.

## Verification

The lab is complete when you can connect your manual password reset for `tempuser01` with Event ID `4724` on `DC01`.

## Security Relevance

Unexpected password resets can indicate account takeover attempts, unauthorized administration, help desk misuse, or malicious persistence. Monitoring is especially important when the affected account has elevated privileges.