Account Password Not Required Changed (UAC Bypass) – Microsoft Defender for Identity
Detects when the “Password Not Required” flag is set or modified on a user account in Active Directory. This change weakens authentication controls and may allow account access without enforcing a password, potentially indicating misuse or attempts to bypass security policies and should be investigated.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor="microsoft"
| #event.dataset="defender-identity.IdentityDirectoryEvents"
| event.action = "account password not required changed"
| #event.outcome = success
| table([@timestamp,user.name,Vendor.properties.TargetAccountUpn,"Vendor.properties.AdditionalFields.TARGET_OBJECT.USER",user.target.name])Detects when the “Password Not Required” flag is set or modified on a user account in Active Directory. This change weakens authentication controls and may allow account access without enforcing a password, potentially indicating misuse or attempts to bypass security policies and should be investigated.
account_password_not_required_changed_uac_bypass_microsoft_defender_for_identity.yml
T1556
Kundan Kumar
Detection
Identity
Identity
2026-05-21
2026-05-21
