SOC Event Lookup
Event ID 4723AccountMgmtP2

Windows Event ID 4723: An attempt was made to change an account's password

Event ID 4723 records an attempt by an account to change its own password.

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-11

Trigger Scenarios

It is generated for self-service password changes, including unsuccessful attempts.

Key Fields

Subject

The account attempting the change.

Target Account

Usually the same account; a mismatch needs investigation.

Status

0x0 indicates success; failures help diagnose stale or policy-rejected attempts.

Common False Positives

  • Normal password rotation and self-service changes are expected.
  • Password-expiry reminders can cause repeated attempts.

Related Events

MITRE ATT&CK Mapping

  • T1098Account Manipulation

Detection Notes

A successful Status 0x0 4723 with a Subject/Target Account mismatch, followed by Type 10 4624 within 60 minutes, supports T1098 account manipulation. The normal self-service case has identical Subject and Target Account.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4723
| project TimeGenerated, Computer, Account, TargetAccount, Status
Splunk SPL
index=wineventlog EventCode=4723 | table _time, host, SubjectUserName, TargetUserName, Status
Sample Log
Subject: CORP\jsmith
Target Account: CORP\jsmith
Status: 0x0

Source