Find the computer a password was changed from

[garyb2008]

Hi

We have a number of users on a windows 2000 domain who share the same user id. One of them changed the password, i since changed it back - but is there a way i can identify the computername / ip / or even an exact time that the user changed it?

This is really so we can identify exactly what happened.

Regards

Gary

 

[itsp1965]

If you have object auditing enabled on your DC then you would have this information in the security log

 

[garyb2008]

and if i dont have it enabled?

i just want to make sure that there wasnt a hacker/virus at work, the password was reset to blank...

 

[itsp1965]

If you don't have it enabled then you won't be able to track it. Have it setup as part of securing your server for the next time something like this occurs

 

[TechyMcSe2k]

install this plug in to get that information...but it is too late for your situation now.

http://www.computerperformance.co.uk/w2k3/utilities/acctinfo.htm

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.