User Account Enabled:
Target Account Name:randy
Target Domain:ELM
Target Account ID:ELM\rsmith
Caller User Name:administrator
Caller Domain:ELM
Caller Logon ID:(0x0,0x158EB7)
Despite MS documentation, this event does not get logged
by W2k but W3 does log this event correctly. However W2k does
log event 642 and identifies the type of change. See example
below: W3 also logs 642 along with this event but the format
of 642 is different compared to W2k. See 642 for W3.
Privileges:-Note Windows 2000 does not log event ID 626 explicitly. Results
are logged as a part of event ID 642 in the description of the message. Windows
Server 2003 DOES logs this event. This event will be accompanied by an event 642.
