Track Outlook Web Access Password Resets

[markzad]

Hello,

Is there a windows security events that I can use to track OWA password changes?

Many thanks,

Mark

[MuS]

Hi markzad

this sounds more like a Windows auditing question rather then a splunk question.

if any of your Windows Servers tracks password changes (audit enabled) and you are indexing its event logs, you will get this event.

cheers,
MuS