KQL Search

This query is designed to identify events in Active Directory where the "Account Password Not Required" setting has been changed for user accounts. Here's a simple breakdown of what the query does:

1. Data Source: It looks at events from IdentityDirectoryEvents, which is a log of directory-related activities.

2. Filter: It specifically filters for events where the action type is "Account Password Not Required changed". This means it only considers changes to the setting that determines whether a password is required for an account.

3. Extract Values: It extracts the new and old values of this setting from a field called AdditionalFields. This is done using parse_json to interpret the data correctly.

4. Select Information: The query then selects and displays specific pieces of information:

   • Timestamp: When the change occurred.
   • TargetAccountUpn: The User Principal Name (UPN) of the account whose setting was changed.
   • TargetAccountDisplayName: The display name of the account.
   • AccountName and AccountUpn: Additional identifiers for the account.
   • NewValue and OldValue: The new and old states of the "Account Password Not Required" setting.

In summary, this query helps administrators track changes to a security-related setting in Active Directory, providing details about when and how the setting was altered for specific user accounts.