Windows Event ID 4723 — Password Change Attempted

Why It Matters

Self-service password changes on privileged accounts (domain admins, service accounts, executive accounts) outside of a helpdesk workflow are a red flag — especially if the Subject and Target Account Names match but the account is not the logged-on user's own. Service account password changes without coordinating with dependent services cause immediate outages and are sometimes used by attackers to lock out the service. Failed 4723 events reveal the accounts an attacker is targeting before a successful compromise.

Key Fields

Investigation Tips

1. 1.Failed 4723 on a high-privilege account (domain admin, service account, executive) indicates an attacker has identified the account and is attempting to take ownership. Treat repeated failures as a precursor to a brute-force or credential-stuffing attempt against that specific account.
2. 2.Service account password changes must be coordinated — the service consuming that account will fail immediately when the password rotates if the configuration is not updated simultaneously. Unexpected service account 4723 events (especially failures) should trigger a review of what services depend on that account.
3. 3.Off-hours self-service password changes on admin accounts are suspicious. Legitimate users change their own passwords during business hours via IT portals. A change at 2am from an unusual workstation is worth reviewing regardless of success or failure.
4. 4.Correlate successful 4723 events with subsequent 4624 logons from the account — if the password change is immediately followed by a logon from a new IP or different workstation, the change may have been performed by an attacker to take over the account.

Related Event IDs

Frequently Asked Questions

What does a failed Event ID 4723 mean?

A failed 4723 means a user attempted to change their own password but provided the wrong current (old) password. The status code 0xC000006A confirms this. From a security perspective, a failure means two things: the account exists (the attacker correctly identified a valid account name), and the attacker does not yet know the current password. Multiple failed 4723 events against admin or service accounts from unexpected workstations indicate a targeted account takeover attempt — the attacker is trying to change the password to lock out the legitimate owner.

What is the difference between Event ID 4723 and 4724?

Event 4723 is a self-service password change — any user can change their own password without admin rights, and the Subject Account Name matches the Target Account Name. Event 4724 is an admin-initiated password reset — the Subject Account (admin) resets the Target Account (another user) and requires elevated privileges. In practice, 4723 with a mismatch between Subject and Target, or 4723 on a service account, often indicates something unusual. 4724 is more directly suspicious when the resetting account itself shows other unusual activity.

Is Event ID 4723 on a service account always a problem?

Not always — scheduled password rotation tools can generate 4723. But unplanned or failed 4723 events on service accounts are worth investigating: a failure means someone tried and failed to change a service account's password (possibly to take control of it), and a success outside your normal rotation window means a service outage is likely imminent if the consuming service was not updated. Correlate with your change management records and check the Workstation Name field — rotation tooling will show a consistent source hostname.