"

How to include change password events performed by users through ctrl+alt+del key combination into product reports?

Last review: Jan 01, 2013
https://kb.netwrix.com/632
Copy Article URL Copied

Is it possible to include change password events performed by the users through ctrl+alt+del key combination into product reports?


Yes, it is possible. Such events are omitted by default. To include them in product reports, please perform the following  steps:
  1. Navigate to the Netwrix Audior for Active Directory installation folder. For example, C:Program Files (x86)NetwrixAcitve Directory Auditing
  2. Locate the omitproplist.txt file and open it with a text editor.
  3. Locate the *.PasswordChanged line, and replace the "*" symbol with "#" (it should now look like #.PasswordChanged).
  4. Save the changes.
Once these changes have been applied, password resets performed by users will by reflected in the product change reports.
Go Up