An attempt was made to reset an account’s password

What it means

An administrator (or a tool) reset someone’s password. 4723 is logged instead when users change their own password.

Why it matters

Resets of admin or service accounts deserve a matching ticket.

What to do

• Check who performed the reset (Subject).
• Alert on resets of privileged accounts.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'Security'; Id = 4724
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.