Event ID 4723AccountMgmtP2
Windows Event ID 4723: An attempt was made to change an account's password
Event ID 4723 records an attempt by an account to change its own password.
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-11
Trigger Scenarios
It is generated for self-service password changes, including unsuccessful attempts.
Key Fields
Subject
The account attempting the change.
Target Account
Usually the same account; a mismatch needs investigation.
Status
0x0 indicates success; failures help diagnose stale or policy-rejected attempts.
Common False Positives
- Normal password rotation and self-service changes are expected.
- Password-expiry reminders can cause repeated attempts.
Related Events
MITRE ATT&CK Mapping
- T1098Account Manipulation
Detection Notes
A successful Status 0x0 4723 with a Subject/Target Account mismatch, followed by Type 10 4624 within 60 minutes, supports T1098 account manipulation. The normal self-service case has identical Subject and Target Account.
SecurityEvent
| where EventID == 4723
| project TimeGenerated, Computer, Account, TargetAccount, Statusindex=wineventlog EventCode=4723 | table _time, host, SubjectUserName, TargetUserName, StatusSubject: CORP\jsmith
Target Account: CORP\jsmith
Status: 0x0