CEF logging
Understand the AD reset events, actor and target fields, and audit coverage of Password Reset integrations.
Password Reset's AD reset component publishes Common Event Format (CEF) events for completed and failed AD reset operations. The configured CEF module and log appenders determine where those events are written; check your deployment rather than assuming every integration writes the same file.
| Event | Meaning |
|---|---|
PWDRESET_001 |
AD password reset performed. |
PWDRESET_002 |
AD password reset failed, including an enforced time restriction. |
These events include the source user, destination account DN, and trace identifier. In delegated operation, use the actor and target together when investigating the reset.
An API rejection before the AD reset component runs does not necessarily produce one of these AD events. Entra ID, Google Workspace, or custom pipes need the audit behavior of their own integration; do not infer that PWDRESET_001 covers all reset backends.
Review event-log access and retention for your installation. Keep passwords, access tokens, assertions, and private-key material out of both operational and diagnostic logs. See Security configuration and the included CEF reference.