AD Account Password Reset but "User must change password at next logon" is not selected

Products Threat Prevention Ideas
,
1

What is a one sentence summary of your feature request?

The end user wants a single event or alert to fire in NTP when an AD account password is reset but “User must change password at next logon” is not selected or checked.

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

In NTP we want an alert (or event) to fire for 2 Active Directory Events events that occur at the same time:

  1. The first event being a “Change Attribute” event where we see the “pwdLastSet” attribute updating to the time the event took place.

  2. The second event being a “Change Attribute” event where we see the “pwdLastSet” attribute NOT being updated to “User must change password next logon”

“User must change password at next logon” is not selected or checked.
Criteria that would be met is that “pwdLastSet” NOT EQUAL 0 (zero).

How do you currently solve the challenges you have by not having this feature?

There is no solution, the team involved requested this alerting feature because they have no alerting solution when a users password is reset and the change password box is not checked.

Hence the request for this needed feature.

2 Likes
2

Hey Mike! Thanks for the submission. I am reviewing this with the team and will report back on how we may be able to proceed.

1 Like
3

Thanks Kevin. It will be appreciated!

4

After discussion with both the NTP and NTM teams, there is no feasible way to accomplish this today without us creating it as an out of the box threat. We’ll look to implement a means for custom threat logic to accommodate this use case in the future. Are there any expectations or requirements for the delivery of something like this?

For what it is worth, the events are tracked but are logged as two separate events.

When the checkbox is set, you’ll see a password change event with the before value being the previous pwdLastSet date and the after value being the new pwdLastSet date (the time the reset occurred). Immediately after an object change event will occur, clearing the pwdLastSet date field, indicating the user has to change their password on next logon.

When the checkbox is not set, that second event does not occur. Unsure if they leverage a SIEM or some other tool that may be able to accommodate this logic in the interim.