Correlated event log message for more details.

Question

In DC agent event log: \Applications and Services Logs\Microsoft\AzureADPasswordProtection\DCAgent\Admin

Event ID 10017 looks like:

The reset password for the specified user was rejected because it did not comply with the current Azure password policy. Please see the correlated event log message for more details.

 UserName: BPL_03283841185
 FullName:

Where to find the "correlated event log message for more details." ?

Answer 1

Hi @Oleksandr ,

It should just be the related event log. You can check in the DC agent service's Admin event log.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-monitor

You can also check the password validation summary using Get-AzureADPasswordProtectionSummaryReport

Sample output:

Get-AzureADPasswordProtectionSummaryReport -DomainController bplrootdc2  
DomainController                : bplrootdc2  
PasswordChangesValidated        : 6677  
PasswordSetsValidated           : 9  
PasswordChangesRejected         : 10868  
PasswordSetsRejected            : 34  
PasswordChangeAuditOnlyFailures : 213  
PasswordSetAuditOnlyFailures    : 3  
PasswordChangeErrors            : 0  
PasswordSetErrors               : 1  

You can also check the trace logs and operation logs as described in the article.