Query Details
Security Change Password Resets
Query
// Security Change or Reset Passwords Attempts // Counts change/reset paswords attempts per target account. SecurityEvent | where EventID in (4723, 4724) | summarize count() by TargetAccount
Explanation
This query counts the number of times a security event related to changing or resetting passwords has occurred for each target account.
Details
Rod Trent
Released: September 3, 2020
Tables
SecurityEvent
Keywords
SecurityEvent,EventID,TargetAccount
Operators
whereinsummarizecount()by