SOC Event Lookup
Event ID 4723AccountMgmtP2

Windows Event ID 4723: An attempt was made to change an account's password

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4723 records an attempt by an account to change its own password.

Technical Metadata

Technical metadata for Event ID 4723
Event ID4723
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success or Audit Failure
MITRE ATT&CKTA0003 Persistence / T1098 Account Manipulation
Key fields to watchSubject, Target Account, Status

Trigger Scenarios

It is generated for self-service password changes, including unsuccessful attempts.

Key Fields

Subject

The account attempting the change.

Target Account

Usually the same account; a mismatch needs investigation.

Status

0x0 indicates success; failures help diagnose stale or policy-rejected attempts.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4723
SecurityEvent
| where EventID == 4723
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4723
index=wineventlog source="WinEventLog:Security" EventCode=4723
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4723
dataset = microsoft_windows_raw
| filter edr_event_id = 4723
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4723
title: Windows Security Event ID 4723
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4723
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
Status0x0The password-change attempt succeeded.A successful change where SubjectUserName and TargetUserName differ can indicate an administrative or unauthorized credential change and requires workflow validation. Source

MITRE ATT&CK Mapping

  • T1098Account Manipulation

Detection Notes

T1098 Account Manipulation is supported when Status is 0x0 and SubjectUserName differs from TargetUserName, because the successful change affected another identity rather than the normal self-service account. Correlate SubjectLogonId with 4624 and review any following 4624 Logon Type 10 from a new source; failed status values require Windows error-code interpretation.

Common False Positives

  • Normal password rotation and self-service changes are expected.
  • Password-expiry reminders can cause repeated attempts.

Related Events

Sample Log

Sanitized event sample
Subject: CORP\jsmith
Target Account: CORP\jsmith
Status: 0x0

Frequently Asked Questions

What does Windows Event ID 4723 mean?

Event ID 4723 records an attempt to change an account password and can represent success or failure.

How is 4723 different from 4724?

Event 4723 covers a password change using the existing credential flow, while 4724 covers an administrative password reset without the old password.

Which 4723 fields identify unusual account manipulation?

Compare SubjectUserName with TargetUserName, inspect Status, and correlate SubjectLogonId with the initiating logon and approved password-change workflow.

Sources