Computer account changed (the machine password reset) > - **Windows Event ID 5829** — Netlogon allowed a vulnerable Netlogon secure channel connection > - **Multiple Netlogon authentication failures** followed by a success in rapid succession > - **DCSync traffic** — DS-Replication-Get-Changes opera