Security Change Password Resets
Query
// Security Change or Reset Passwords Attempts
// Counts change/reset paswords attempts per target account.
SecurityEvent
| where EventID in (4723, 4724)
| summarize count() by TargetAccountExplanation
This query counts the number of times a security event related to changing or resetting passwords has occurred for each target account.
Details
Rod Trent
Released: September 3, 2020
Tables
SecurityEvent
Keywords
SecurityEventEventIDTargetAccount
Operators
whereinsummarizecount()by