Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

MARS 5.3 - Locate who/what is applying password reset on users account

A users account within the AD is repeatedly being set to change password at next logon. How can I search for the cause in MARS or is this type of event not logged?

4 REPLIES
Gold

Re: MARS 5.3 - Locate who/what is applying password reset on use

I believe it will have event id 642 in Windows 2000 or 2003. Google that event id for more information.

New Member

Re: MARS 5.3 - Locate who/what is applying password reset on use

Thank you.

Can you explain how I can search for this event in MARS?

Gold

Re: MARS 5.3 - Locate who/what is applying password reset on use

For this example, username is BOB. open up notepad and type:

642Security

Where is the tab key. If you use a space, this won't work. Now ctrl-a to select all and ctrl-c to copy.

Now create a query.

query type = events ranked by time

time range = whenever you think this happened

keyword = AND BOB

submit.

New Member

Re: MARS 5.3 - Locate who/what is applying password reset on use

Thank you very much. Appreciated.

127
Views
5
Helpful
4
Replies