SQL Server Audit Action Group: LOGIN_CHANGE_PASSWORD_GROUP

This group tracks password changes and password resets of SQL Server logins. This group does not track password changes for Windows or Active Directory user accounts.

This is a server level audit action group only it cannot be included in database specifications.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24004	Change own password succeeded
24005	Change own password failed
24006	Change password succeeded
24007	Change password failed
24008	Reset own password succeeded
24009	Reset own password failed
24010	Reset password succeeded
24011	Reset password failed
24012	Must change password
24013	Account unlocked

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard