⚑ Deus Ex Machina ➽ Eventlog Lookup

Deus Ex Machina » Eventlog » Event 4738 - Microsoft Windows security auditing

Microsoft Windows security auditing - 4738


Success

Description »
A user account was changed.

Subject:
	Security ID:		NTDOMAIN\asmith
	Account Name:		asmith
	Account Domain:		NTDOMAIN
	Logon ID:		0x29AA6

Target Account:
	Security ID:		LOCALCOMPUTERNAME\TESTZZ
	Account Name:		TESTZZ
	Account Domain:		LOCALCOMPUTERNAME

Changed Attributes:
	SAM Account Name:	TESTZZ
	Display Name:		TESTZZ
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	01/01/2014 14:19:32
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x10
	New UAC Value:		0x10
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		All

Additional Information:
Data formatted as » EventData
 Dummy - 
  TargetUserName TESTZZ 
  TargetDomainName LOCALCOMPUTERNAME 
  TargetSid S-1-5-21-1901825159-2140724311-413569567-1003 
  SubjectUserSid S-1-5-21-245765006-1623854500-3105827926-60516 
  SubjectUserName asmith 
  SubjectDomainName NTDOMAIN 
  SubjectLogonId 0x29aa6 
  PrivilegeList - 
  SamAccountName TESTZZ 
  DisplayName TESTZZ 
  UserPrincipalName - 
  HomeDirectory %%1793 
  HomePath %%1793 
  ScriptPath %%1793 
  ProfilePath %%1793 
  UserWorkstations %%1793 
  PasswordLastSet 01/01/2014 14:19:32 
  AccountExpires %%1794 
  PrimaryGroupId 513 
  AllowedToDelegateTo - 
  OldUacValue 0x10 
  NewUacValue 0x10 
  UserAccountControl - 
  UserParameters - 
  SidHistory - 
  LogonHours %%1797 

A local (not active directory) user account has been changed. This may be a password reset, or may be any attribute of the account being changed (eg the Full Name or Description).

The changes will be somewhere in the description and the eventdata, but note that not everything that appears to have changed actually has done. For example - the above sample is from a password reset, using the lusrmgr.msc mmc snap-in, but this also seems to result changes to (among other things) the home folder, password expiry and logon hours, even though only the password (and therefore the password last set attribute) has been changed. This behaviour is the same when using net user [username] Pa55w0rd! to set the password.

The "subject" account is the one which has made the change. The "target" account is the one to which the change was made.