How to audit Admin account password changes of Local DB accounts.

When an administrator would like to know follows about Firewall admin account of Local DB, this article may help an administrator.

• When Admin account password was changed?
• Which Admin account changed an Admin account password?
• Which Admin account password was changed?

• Next Generation Firewall
• PAN-OS 10.1
• PAN-OS 10.2

1. Go to Monitor > Logs > Configuration.
2. Apply the filter "after-change-preview contains phash".

3. In the example shown in the above logs:
   1. Admin account name "mgr" changed the password of account name "test2" at 17:50:02 on 9/29.
   2. Admin account name "mgr" changed the password of account name "test" at 17:34:10 on 9/29.
   3. Admin account name "admin" changed the password of account name "test2" at 17:24:59 on 9/29.

When the admin account owner changes his own password, Configuration log does not log entries about it.