Is it possible to include change password events performed by the users through ctrl+alt+del key combination into product reports?
Yes, it is possible. Such events are omitted by default. To include them in product reports, please perform the following steps:
- Navigate to the Netwrix Audior for Active Directory installation folder. For example, C:Program Files (x86)NetwrixAcitve Directory Auditing
- Locate the omitproplist.txt file and open it with a text editor.
- Locate the *.PasswordChanged line, and replace the "*" symbol with "#" (it should now look like #.PasswordChanged).
- Save the changes.
Once these changes have been applied, password resets performed by users will by reflected in the product change reports.