SOC Event Lookup
Event ID 4724AccountMgmtP1

Windows Event ID 4724: An attempt was made to reset an account's password

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4724 records an attempt to reset another account's password and is important for account-takeover investigations.

Technical Metadata

Technical metadata for Event ID 4724
Event ID4724
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success or Audit Failure
MITRE ATT&CKTA0003 Persistence / T1098 Account Manipulation
Key fields to watchSubject, Target Account, Status

Trigger Scenarios

The event is logged when an administrator, helpdesk workflow, or other principal resets a user password rather than changing its own password.

Key Fields

Subject

The identity that attempted the reset. Confirm it is an approved administrator or identity-management process.

Target Account

The account whose password was reset. Privileged, service, and recently created accounts deserve special attention.

Status

The operation result. Failed resets can reveal attempted but blocked account abuse.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4724
SecurityEvent
| where EventID == 4724
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4724
index=wineventlog source="WinEventLog:Security" EventCode=4724
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4724
dataset = microsoft_windows_raw
| filter edr_event_id = 4724
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4724
title: Windows Event ID 4724
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4724
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
Status0x0The password-reset operation succeeded.A successful reset of a privileged or service account outside an approved workflow can give an actor durable access with a credential they control. Source

MITRE ATT&CK Mapping

  • T1098Account Manipulation

Detection Notes

T1098 Account Manipulation is signaled when Subject resets a privileged or service Target Account and Status is 0x0, followed by 4624 from a new Client Address. A successful reset outside approved helpdesk workflows gives an attacker a new valid credential, unlike a failed policy attempt.

Common False Positives

  • Helpdesk and self-service identity workflows legitimately reset passwords.
  • Emergency access procedures may reset privileged accounts during incidents.

Related Events

Sample Log

Sanitized event sample
Subject: CORP\helpdesk01
Target Account: CORP\admin.ops
Status: 0x0

Frequently Asked Questions

What does Windows Event ID 4724 mean?

Event ID 4724 records an attempt by one account to reset another account's password and can be generated for successful or failed attempts.

How is a password reset different from a password change?

A reset is performed without supplying the target account's old password, while event 4723 covers an attempt to change an account password using the existing credential flow.

Which 4724 events deserve immediate review?

Prioritize successful resets of privileged, service, dormant, or break-glass accounts by an unexpected subject, especially when followed by a logon from a new source.

Sources