AD Account Password Reset but "User must change password at next logon" is not selected

Products Threat Prevention Ideas
,
1

What is a one sentence summary of your feature request?

The end user wants a single event or alert to fire in NTP when an AD account password is reset but “User must change password at next logon” is not selected or checked.

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

In NTP we want an alert (or event) to fire for 2 Active Directory Events events that occur at the same time:

  1. The first event being a “Change Attribute” event where we see the “pwdLastSet” attribute updating to the time the event took place.

  2. The second event being a “Change Attribute” event where we see the “pwdLastSet” attribute NOT being updated to “User must change password next logon”

“User must change password at next logon” is not selected or checked.
Criteria that would be met is that “pwdLastSet” NOT EQUAL 0 (zero).

How do you currently solve the challenges you have by not having this feature?

There is no solution, the team involved requested this alerting feature because they have no alerting solution when a users password is reset and the change password box is not checked.

Hence the request for this needed feature.