SQL Server Audit Log Event ID 24012
24012: Must change password (action_id PWMC)
This is an event from
SQL Server
audit event from
LOGbinder SQL
generated by
.
On this page
A principal must change their password at next login
Free Security Log Resources by Randy
| Field | Description |
|---|
| Occurred | When event was reported by SQL Server |
| Session ID | ID of the session on which the event occurred |
| User | |
| Server | |
| Target object | |
| | ID | Target object ID |
| | Name | Target object name |
| | Type | Target object type |
| Statement | Transact-SQL statement |
Setup PowerShell Audit Log Forwarding in 4 Minutes
This Event Is Produced By
Which Integrates with Your SIEM
Must change password
A principal must change their password at next login
Action Group: LOGIN_CHANGE_PASSWORD_GROUP
Occurred: 8/22/2013 6:07:50.0000000 PM
Session ID: 67
User: LB\Administrator
Server: DEV3
Target Object
ID: 272
Name: TestLogin1
Type: SQL login
Statement: ALTER LOGIN TestLogin1 WITH PASSWORD = '******' MUST_CHANGE
For more information, see http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=24012
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection