An attacker changing the password of an account they have compromised.
What gives it awayA change from an unusual source address, or shortly after an unfamiliar sign-in, locking the legitimate owner out quietly.
ATT&CK T1098Windows Security Log · Event 4723
Event 4723: A user changed their own password
Someone changed their own password, supplying the old one to do it. That is what separates it from Event 4724, where an administrator resets a password without knowing the current one — and it is why 4723 is the far less interesting of the two.
Also written as Event ID 47234723 password change
- How oftenFires regularly
- Vendor calls itAudit Success
- LogSecurity
- SourceMicrosoft-Windows-Security-Auditing
What it means for you
On a personal computer
You, or whoever uses this account, changed the password in the normal way.
For an analyst
Compare SubjectUserName against TargetUserName. When they match, the account holder knew the old password. When they differ, someone changed another user's password while knowing the current one, which is unusual enough to look at.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
An attempt was made to change an account's password.
Subject:
Security ID: CORP\jbrooks
Account Name: jbrooks
Account Domain: CORP
Logon ID: 0x3E9A11
Target Account:
Security ID: CORP\jbrooks
Account Name: jbrooks
Account Domain: CORPThe fields that decide it
Everything else in the log line is context.
- TargetUserName
- The account whose password changed.
- SubjectUserName
- Who performed the change. Normally the same as the target.
-
Same as TargetUserNameOrdinary self-service password change. -
Different from TargetUserNameSomeone changed another account's password while knowing the current one. Worth a look. - SubjectLogonId
- The session that made the change.
Ordinary reasons this happens
Most of the time it is one of these.
- A user changing their password on request at expiry.
- Someone changing a password voluntarily.
- A password change forced by policy at next sign-in.
- Service account rotation performed by automation that holds the current password.
When it is not ordinary
A change performed by someone other than the account holder.
What gives it awaySubjectUserName differing from TargetUserName, meaning the current password was known to a third party.
ATT&CK T1098What to do next
- Compare the subject and target accounts. Matching is the ordinary case.
- If they differ, find out how the subject knew the current password.
- Join on Logon ID to the 4624 for the source address, and check it is one the user normally uses.
- For service accounts, confirm the change matches a scheduled rotation.
Queries to run
SecurityEvent | where EventID == 4723 | where SubjectUserName != TargetUserName | project TimeGenerated, Computer, Target = TargetUserName, ChangedBy = SubjectUserNameCommon questions
What is the difference between Event 4723 and Event 4724?
4723 is a password change where the current password was supplied — normally a user changing their own. 4724 is an administrative reset performed without knowing the old password. 4724 is the one worth monitoring, because it represents taking over access rather than maintaining it.
Does Event 4723 mean the password change succeeded?
Not on its own. The message says an attempt was made, and Windows records failures too — check whether the event is logged as Audit Success or Audit Failure. A run of failures usually means the new password did not satisfy the complexity or history policy.
Read next
- The equivalent of Event 4724: An attempt was made to reset an account's password An administrative reset, where the old password was not required. The more security-relevant of the pair.
- Read alongside Event 4738: A user account was changed The account-changed event, written alongside this one.
- Usually comes before Event 4624: An account was successfully logged on The sign-in the change was made from.
Vendor documentation
Last reviewed 28 August 2026