Windows Security Log Event ID 647
Operating Systems Windows Server 2000
Windows Server 2003
Category Account Management
Type Success
Corresponding events
in Windows 2008
and Vista 		4743  
Discussions on Event ID 647

647: Computer Account Deleted

On this page

"Caller" user deleted "target" computer account.

Note, this event also gets logged when a trust relationship is deleted. "Target" account name will correspond to the trusted/ing domain appended with a $.

Free Security Log Quick Reference Chart

Description Fields in 647
  • Target Account Name: %1
  • Target Domain: %2
  • Target Account ID: %3
  • Caller User Name: %4
  • Caller Domain: %5
  • Caller Logon ID: %6
  • Privileges: %7

Top 10 Events to Monitor

Examples of 647

Computer Account Deleted:
Target Account Name:COMP1$
Target Domain:ELMW2
Target Account ID:comp1
Caller User Name:Administrator
Caller Domain:ELMW2
Caller Logon ID:(0x0,0x12D622)
Privileges:-

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this
Mini-Seminars Covering Event ID 647
Discussions on Event ID 647
Ask a question about this event

 

Upcoming Webinars
Additional Resources