• Introducing WebPros Cloud - a fully managed infrastructure platform purpose-built to simplify the deployment of WebPros products !  WebPros Cloud enables you to easily deliver WebPros solutions — without the complexity of managing the infrastructure.
    Join the pilot program today!
  • Support for BIND DNS has been removed from Plesk for Windows due to security and maintenance risks.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS.

Question Track who changed an email password and when

finbarr69

Basic Pleskian
Hi,

Just had one of my customers return from a week off to find their email password was changed. It wasn't me, and we don't believe it was their boss, so suspecting foul play (although there appears to be no sign of anything malicious, so may have been an accidental password change by the user when they turned on their out of office message in the webmail).

Is there a log of user password changes in Plesk, with a record of the IP address it was changed from?

If not, is there an add-on that could record any future password changes?

Thanks

Brian
 
You can see all actions that are performed via Plesk in the Plesk Action Log:
Tools & Settings => Action Log

Password changes are recorded there like this:
IP.IP.IP.IP <PLESK-USER> [2021-10-12 17:06:43] 'Update Mailname' ('Client GUID': 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' => 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Domain GUID': 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' => 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Mail preferences': 'false' => 'true', 'Mailname': '[email protected]' => '[email protected]', 'Password': '++++++' => 'xxxxxx')

There is also a new extension by Plesk that will display the action log in a nice format:
 
Back
Top