KQL Search

Query Details

Security Change Password Resets

Query

// Security Change or Reset Passwords Attempts 
// Counts change/reset paswords attempts per target account. 
SecurityEvent
| where EventID in (4723, 4724)
| summarize count() by TargetAccount

Explanation

This query counts the number of times a security event related to changing or resetting passwords has occurred for each target account.