Alert when anyone reset password

[aalhabbash1]

Hi Splunker;

I need to create alert when anyone make reset password for his account in windows logs exception the user did reset password because the his account expired password?

Best Regards;
Abdullah Al-Habbash

[uhaq]

Would need more information on what sort of monitoring is setup from your domain controllers...

I can break this down to two issues:
1) Passwords resets:
Assuming you are onboarding windows security logs, have you looked at Windows Event ID 4724/4723 for passwords reset?
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4724

2) Accounts expired or near expiration:
Assuming you are onboarding windows security events, there should be an 'Account Expires' field for a user related event, that you can try creating some analytics around.

[koshyk]

Have a check for EventID 4724
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4724

Please analyse these events and see how your organisation manages password resets
Most of them is done within Active Directory and hence you may need to filter them out. Do try simulating a real reset and see how the data is present for 4724 eventID