Windows Security Log Events by ID

On Windows 2000, this event gets logged for both succesful and failed attempts for both password changes (user changing his own password) or password resets when one user (caller user) attempts to change the password of another user (target user).

On Windows Server 2003 this event is only logged when a user changes his own password. For password resets by administrators see event 628. This event will also be accompanied by event 642 showing that the Password Last Set date field was updated.