Eventlog Type: Security
Eventlog Source: Security
Event ID: 628
Link to KB Entry
Short Description:
User Account Password Set
This event indicates that the password for the specified user account (Target Account) was reset. The password of a user object can be reset only by someone who was granted the Reset Password right by the ACL on the user object, or who is a member of one of the following groups: Administrators, Account Operators, Domain Administrators, or Enterprise Administrators. This event might indicate that someone is trying to make changes without the appropriate permissions.
User Account Password Set