Run a SQL query against the database to locate the event where the password was changed for an account during a specific time frame.
Select * from tblalertlog where actiontext like '%skohl%' AND EventDefinitionCode like '%USRPWD%'
AND TimeAudited > '09/25/2016' AND TimeAudited < '10/02/2016'
Results:
