Event ID 4723 is a Windows Security audit event for an attempted password change on an account. It records both successful and failed attempts, including cases where the new password breaks policy or, for local accounts, the old password is wrong. Monitor the subject and target account fields for unauthorised change activity.
What Event ID 4723 Tells You
Event ID 4723 is more than a generic audit marker, it is the Windows signal that someone attempted to change a password on an account. Because it captures both successful and failed attempts, it helps distinguish normal administration from suspicious activity, policy violations, or credential tampering.
This event is most useful when read with surrounding audit activity. A single password-change attempt may be legitimate, but repeated failures, unusual source hosts, or changes against privileged accounts can indicate abuse, confusion in account handling, or an active attack path that is trying to disrupt access or seize control.
For teams that already centralise Windows auditing, the broader Windows Event Log Guide is the most direct companion resource because it places 4723 alongside the account-change and logon events that usually give the surrounding context.
Where Event ID 4723 Fits in Windows Auditing
Event IDs in the 4720s are part of the account-management story in Windows security logs. 4723 specifically sits in the password-change workflow, so it belongs to the control plane around account hygiene, helpdesk operations, and suspicious identity activity rather than to application logging or endpoint telemetry alone.
The event typically matters when an account owner, administrator, or automated process attempts a password change and the system records the outcome. In local-account scenarios, a failed old password can generate the event, while domain and policy-driven environments may also produce failures when the requested password does not meet complexity or policy rules.
That makes 4723 a useful audit pivot: it does not tell the whole story by itself, but it tells you that a password-change action was attempted and that the environment should be checked for the actor, target, and result.
What To Look For in the Event Fields
The subject account field and target account field are the two most important values to compare. If the subject is a helpdesk operator, service desk queue, or admin account and the target is a privileged account, the event deserves closer review because the action may be part of a legitimate reset workflow or a misuse attempt.
Repeated failed password-change attempts against the same account can indicate guessing, stale credentials, or a user locked into an incorrect recovery path. A successful change outside normal support hours, or from an unusual workstation, can be just as important as a failed one because it may show that access has already been altered.
Correlate 4723 with interactive logon events, privilege events, and account-management events to decide whether the change was expected, authorised, and consistent with the account’s normal lifecycle.
Why Event ID 4723 Matters for Detection and Response
Event ID 4723 is valuable because password changes are a control point for both security and availability. Unauthorised attempts can be an early sign of account tampering, while successful changes can strand users, disrupt operations, or hide follow-on compromise if an attacker has already taken over an account.
A strong monitoring program treats this event as a cue to review the surrounding timeline, not as a standalone verdict. The question is whether the password change was initiated by the right actor, from the right context, for the right account, and whether any related access material, such as sessions or recovery channels, should also be reviewed.
When the account is privileged or automatable, the event can also indicate a broader control issue, especially if password changes are not tightly governed or if multiple systems share the same credential pattern. In those cases, follow-up review should be part of the response, not an afterthought.
Risk and Threat Considerations
Unauthorised password-change attempts can be used to disrupt access, probe policy weakness, or support account takeover workflows. The risk is higher when the target is privileged, shared, or tied to operational continuity, because a successful change can lock out legitimate users or help an attacker persist unnoticed.
Failure mechanism: Attackers or mistaken operators exploit weak change controls, predictable recovery processes, or poor log review to alter credentials without detection.
Impact: The result can be service disruption, loss of account control, credential churn, or delayed detection of a compromise that is already in progress.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers password and authenticator lifecycle controls relevant to change attempts. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Supports monitoring and investigation of security audit events like 4723. | |
| Recommendation — Review authenticator change events and enforce controlled reset and change procedures. Correlate password-change events with surrounding logs and investigate anomalies promptly. | ||
| CIS Controls v8 | CIS-5 — Account Management | Addresses monitoring and governance of account changes, including password updates. |
| Recommendation — Track account-change activity and flag unexpected password modifications for review. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | Captures adversary modification of accounts and credentials to maintain or gain access. |
| Recommendation — Map suspicious password-change activity to account-manipulation detections and hunt for abuse. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity Management | Relevant because password-change events are part of identity lifecycle and access governance. |
| Recommendation — Govern who may change credentials and verify that changes align with approved identity processes. | ||
Practitioner Guidance
What to watch for: Treat 4723 as a review trigger when the subject and target accounts do not fit normal support patterns, when attempts cluster around privileged identities, or when password-change failures recur without a clear user explanation. Those patterns usually matter more than the event by itself.
Practitioner takeaway: The best use of 4723 is correlation, because the event is most actionable when it is tied to account ownership, source context, and the surrounding logon and account-change trail.