01Fields in the event
- TargetUserName
- TargetDomainName
- TargetSid
- SubjectUserSid
- SubjectUserName
- SubjectDomainName
- SubjectLogonId
02How to use it
Identify who reset whose password and whether the target account logged on from a new source afterwards. Resets on high-value or service accounts deserve review.
03Caveats
Requires Audit User Account Management. No failure event is generated when the attempt is refused with Access Denied.