https://community.splunk.com/t5/Monitoring-Splunk/Track-Outlook-Web-Access-Password-Resets/m-p/45291#M507 <P>Hi markzad</P> <P>this sounds more like a Windows auditing question rather then a splunk question.</P> <P>if any of your Windows Servers tracks password changes (audit enabled) and you are indexing its event logs, you will get this event.</P> <P>cheers,<BR /> MuS</P> Tue, 28 Aug 2012 11:08:53 GMT MuS 2012-08-28T11:08:53Z https://community.splunk.com/t5/Monitoring-Splunk/Track-Outlook-Web-Access-Password-Resets/m-p/45290#M506 <P>Hello,</P> <P>Is there a windows security events that I can use to track OWA password changes?</P> <P>Many thanks,</P> <P>Mark</P> Tue, 28 Aug 2012 10:59:06 GMT https://community.splunk.com/t5/Monitoring-Splunk/Track-Outlook-Web-Access-Password-Resets/m-p/45290#M506 markzad 2012-08-28T10:59:06Z https://community.splunk.com/t5/Monitoring-Splunk/Track-Outlook-Web-Access-Password-Resets/m-p/45291#M507 <P>Hi markzad</P> <P>this sounds more like a Windows auditing question rather then a splunk question.</P> <P>if any of your Windows Servers tracks password changes (audit enabled) and you are indexing its event logs, you will get this event.</P> <P>cheers,<BR /> MuS</P> Tue, 28 Aug 2012 11:08:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/Track-Outlook-Web-Access-Password-Resets/m-p/45291#M507 MuS 2012-08-28T11:08:53Z