A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. Assuming that the user is not lying to the question whether he reset the password himself is there any other reason besides a hacking attempt on that user account due to which the password was reset?

If it was a hacking attempt from an amateur (an he didn't modify the log files) in which log file would the password reset been written?

  • is this a local account or on an Active Directory? – Callum Wilson Jan 28 '13 at 9:55
  • it's a local account – b00tsy Jan 28 '13 at 10:14
  • 1
    one more question: do you have any password policies in force that would normally prevent an empty password? (just trying to work out whether this is user error or indeed something quite new and interesting) – Callum Wilson Jan 28 '13 at 10:46
  • I'm leaning towards user error, unless you have an enforced password policy. You could check the Security event log for the password change audit event. – Polynomial Jan 28 '13 at 11:01

Local user password changes should register as audit events in the Windows event log, under Security. The event ID is 627: Change Password Attempt if the user changed the password himself, or 628: User Account Password Set if another user performed the change.

You can reach the log via:

Start » Run... » eventvwr.msc » Windows Logs » Security

You can filter the log using the Filter Current Log button on the right panel, and enter 627 and 628 in the event ID filter list.

  • 3
    thanks. The log showed the user changed the pw last friday morning. After showing him the log he suddenly "remembered" changing the password on that day ;) – b00tsy Jan 28 '13 at 11:34
  • 2
    Never underestimate a user's ability to break things in stupid ways :) – Polynomial Jan 28 '13 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.