Hello Donny,

When an admin user changes a password from another user, normally you see this in Information Events:

Parameter Description: "Security Edited"

Value: User -"username":-password, full name changed - by "user"

regarding the logs, you will see it in SLNet logs - but keep in mind that this log overwrites very fast