Windows Event ID 4723 – Microsoft-Windows-Security-Auditing: User Account Password Change Attempt

Start by examining the specific Event ID 4723 details to understand the password change context and identify the involved accounts.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4723 in the Event IDs field and click OK
5. Double-click on Event ID 4723 entries to view detailed information
6. Review the following key fields in the event details:
   • Subject: Account that initiated the password change
   • Target Account: Account whose password was changed
   • Workstation Name: Source computer for the operation
   • Process Information: Application or service that performed the change

Use PowerShell to efficiently query and analyze Event ID 4723 occurrences across your environment with advanced filtering capabilities.

1. Open PowerShell as Administrator
2. Query recent Event ID 4723 entries with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4723} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4723; StartTime=$StartTime; EndTime=$EndTime}

4. Extract detailed event properties for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4723} -MaxEvents 10 | ForEach-Object {
       [xml]$EventXML = $_.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           TargetUserName = ($EventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
           WorkstationName = ($EventData | Where-Object {$_.Name -eq 'WorkstationName'}).'#text'
       }
   }

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4723} | Export-Csv -Path "C:\Temp\PasswordChanges.csv" -NoTypeInformation

Ensure proper audit policy configuration to capture Event ID 4723 consistently across your Windows environment.

1. Open Group Policy Management Console or run gpedit.msc for local policy
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Account Management and locate Audit User Account Management
4. Configure the policy to audit both Success and Failure events
5. Verify current audit settings using PowerShell:

   auditpol /get /subcategory:"User Account Management"

6. Apply audit policy changes immediately:

   gpupdate /force

7. Test the configuration by performing a password change and verifying Event ID 4723 generation
8. For domain environments, link the Group Policy Object to appropriate Organizational Units

Set up automated monitoring for Event ID 4723 to detect suspicious password change patterns and maintain security oversight.

1. Create a PowerShell script for continuous monitoring:

   # Monitor-PasswordChanges.ps1
   $LastCheck = (Get-Date).AddMinutes(-5)
   while ($true) {
       $Events = Get-WinEvent -FilterHashtable @{
           LogName='Security'
           Id=4723
           StartTime=$LastCheck
       } -ErrorAction SilentlyContinue
       
       foreach ($Event in $Events) {
           [xml]$EventXML = $Event.ToXml()
           $EventData = $EventXML.Event.EventData.Data
           $Subject = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           $Target = ($EventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
           
           Write-Host "Password change detected: $Subject changed password for $Target" -ForegroundColor Yellow
           # Add alerting logic here
       }
       
       $LastCheck = Get-Date
       Start-Sleep -Seconds 300
   }

2. Configure Windows Task Scheduler to run the monitoring script:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-PasswordChanges.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "Monitor Password Changes" -Action $Action -Trigger $Trigger -Principal $Principal

3. Set up email notifications for critical events using PowerShell:

   Send-MailMessage -To "security@company.com" -From "alerts@company.com" -Subject "Password Change Alert" -Body "Event ID 4723 detected" -SmtpServer "mail.company.com"

4. Integrate with SIEM solutions by forwarding events using Windows Event Forwarding or log shipping agents

Perform comprehensive forensic analysis of Event ID 4723 patterns to identify security incidents and administrative anomalies.

1. Create a comprehensive analysis script for pattern detection:

   # Analyze-PasswordChangePatterns.ps1
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4723} -MaxEvents 1000
   $Analysis = @{}
   
   foreach ($Event in $Events) {
       [xml]$EventXML = $Event.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       $Subject = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
       
       if ($Analysis.ContainsKey($Subject)) {
           $Analysis[$Subject]++
       } else {
           $Analysis[$Subject] = 1
       }
   }
   
   # Identify accounts with high password change activity
   $Analysis.GetEnumerator() | Sort-Object Value -Descending | Select-Object -First 10

2. Cross-reference with other security events for comprehensive analysis:

   # Correlate with logon events
   $PasswordChanges = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4723} -MaxEvents 100
   $LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 1000
   
   # Analyze temporal correlation between password changes and logons

3. Generate detailed forensic reports:

   $Report = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4723} | ForEach-Object {
       [xml]$EventXML = $_.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       [PSCustomObject]@{
           Timestamp = $_.TimeCreated
           Administrator = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           TargetUser = ($EventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
           Workstation = ($EventData | Where-Object {$_.Name -eq 'WorkstationName'}).'#text'
           ProcessName = ($EventData | Where-Object {$_.Name -eq 'ProcessName'}).'#text'
       }
   }
   
   $Report | Export-Csv -Path "C:\Forensics\PasswordChangeAnalysis.csv" -NoTypeInformation

4. Check registry settings for audit configuration:

   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "MaxSize"

5. Validate audit policy effectiveness across domain controllers using Group Policy Results