urgent help!

[John]

Hi all,

We just found out that our administrtator password was changed last night.
I am looking at security logs now. Can anyone help me how I find out who
changed the password and through which computer? any specific ID?

Thank you!!!

Windows 2003 R2 environment

 

[Marcin]

John,
refer to
http://www.windowsecurity.com/articles/Auditing-Users-Groups-Windows-Security-Log.html
hth
Marcin