Windows Password Change Scenarios

Transcription

1 Windows Password Change Scenarios Summary This document captures various Windows environment password change scenarios and the underlying event data. It covers NetVision s ability to capture the events, challenges associated to processing the raw data, notes on final report preparation, and information on related Microsoft Security Event Log events. Overview NetVision captures Windows and Active Directory event information from-the-source. NVMonitor does not rely solely on event log information. In fact, many NVMonitor implementations are configured to completely ignore Windows event logs. This means reduced effort to set and maintain audit settings, manage logs, etc. and access to more complete event information. However, NVMonitor does offer event log monitoring as a capability within the solution. Often, to meet specific business requirements, an analysis is required of the various event types and data to determine the best approach to meet the requirements. And in some cases, a hybrid approach of monitoring events natively while also watching certain Security Event Log events becomes the ideal configuration. The most common method of capturing password change events within NVMonitor is by leveraging the Active Directory OBJECT MODIFY event. This event is filtered based on object class (USER) and attribute (pwdlastset). A change to a user s pwdlastset attribute indicates that a password change has occurred. The evaluation of the value of that attribute varies, however, by situation. pwdlastset Attribute Typically, the value of pwdlastset is a large integer representing the date and time that the user s password was last changed. When the user s password is reset and the option is selected to force the user to change password upon next logon, the attribute is set to 0. And as long as the Don t expire password flag is not set in the UserAccountControl attribute, the user will be forced to change their password upon logon. Generally, monitoring changes to pwdlastset provides a clear audit trail of user account password changes, when those changes occur, and who is initiating the changes. Simply watching the raw data, however, could raise questions about what is actually happening behind the scenes. The following scenarios attempt to capture those intricacies.

2 Password Change Scenarios 1. Password is set for an account and User Must Change Password at Next Logon is NOT selected (new or existing user) 2. Password is set for an account and User Must Change Password at Next Logon IS SELECTED (new or existing user) 2 pwdlastset is changed to 0 from timestamp. 3 pwdlastset is changed to 0 from (blank value). (same as above) Before & after values represent actual AD changes. (same as above) Before value contains no data. Note: Duplicate events in this scenario are excluded from NetVision reports.

3 3. Authenticated User changes own password The User matches the DN of the affected object. 4. Password change is attempted but fails due to domain password policy 1 No change is made to pwdlastset. Not Applicable (optionally available) Further evaluation of the event is required to determine if the attempt was successful.

4 5. Password is set via Third Party application such as a user password self-service portal The User is typically a common service account for all activity originating within the application. These can be excluded from NetVision reports or otherwise handled as appropriate. 6. User authenticates and is forced to change password based on User Must Change Password at Next Logon being enabled 2 LastLogon is almost simultaneously set to a current timestamp. event occurs on pwdlastset. The event includes the AD User Because the password change occurs prior to authentication, the event is initiated as NT AUTHORITY\ANONYMOUS LOGON. (optionally available) Event ID An account was successfully logged on Event ID An account was successfully logged on

5 Conclusion There are multiple methods of capturing Windows password changes using NVMonitor. There are a few points for potential confusion when evaluating the raw event data as it comes through. For example, a NetVision Object Modify policy that watches for changes to the USER pwdlastset attribute and filtering on NT AUTHORITY\ANONYMOUS LOGON as the perpetrator will see events under normal network operation. These events occur when a user is forced to change their password upon logon as indicated by the pwdlastset value of 0. Also, in the event of a password reset while User Must Change Password at Next Logon is selected, there are multiple attribute updates to pwdlastset that need to be accounted for via NVMonitor report configuration. NetVision s reporting can be configured to correct the representation of these and other events so that the actual correct USER is always being represented in the report instead of Anonymous Logon and duplicate events are filtered out for a single action. To monitor the occurrence of a password change event where Anonymous Logon is provided as the user account, you might want to also check the previous value of pwdlastset which would be 0 and the lastlogon value to determine if this is a forced user password change, which is a common occurrence as the result of a helpdesk password reset. Alerts can be generated if the evaluation determines that the event is NOT actually a forced user password change based on either the user information or the previous value of the pwdlastset attribute. NetVision s NVMonitor is a powerful tool which has the ability to capture native system events as well as to monitor the servers Security Event Logs. Generally, it is simple to create NVMonitor policies to capture common scenarios such as user account creations, security group changes, and file access events. It is occasionally necessary, however, to carefully deploy policies in a way that closely aligns to business requirements. This is especially true if the raw data doesn t obviously match up with expectations (such as when Anonymous Logon is presented as the actor in the case of a password ) NetVision s support team is available to assist in policy and report configuration. Visit for contact information.