What steps do I need to take to ensure I get an alert if a user changes their password? It would seem easy but I'm definately missing the boat on this one.
What password? AD, Kaseya or ...
That WOULD be helpful wouldn't it :)
Windows 7 user account.
Ok, the difference is between Windows 7 on workgroup and Windows 7 in domain enviroment.
In first case the event is a local event on security event log (EventID 4728 or similar); in second case the event is in security event log of a domain controller (EventID 627 or similar). I don't remember the correct EventID but yuo can try this ...
You need to setup an alert in Monitor -> Agent Monitorig -> Event Log Alerts or in event viewer on KLC and you click the icon near the desired event to monitor it.
... I write without try it ...
If you are in a work-group environment why not disable the users ability to change their password? You can script this by using "net user" in a cmd script.