Hello, Need all ur help. My server is Window 2003, a few day before happened one case, one of the local ID been changed password with somebody, cause all the application been failed. My question is, can I get the information about who & when this ID password been change from window event or somewhere in my server?Judy

Hi Judy, You can use the USER_LOGON_INFO script. Add User Account Information to Active Directory Users and Computers http://www.petri.co.il/add_user_account_information_to_dsa.htm BrentBrent Hu Forum Support Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

This is past event, can work? Our server was not in Active Directory, cannot move.Judy

Hi Judy, I would like to suggest that you submit a new thread in our Scripting forum for better and accurate answer to the question. The community members and support professionals there are more familiar with scripting and can help you in a more efficient way. For your convenience, I have listed the Forum link below: Scripting Forum http://social.technet.microsoft.com/Forums/en-us/ITCG/threadsBrent Hu Forum Support Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.