Windows Security Log Event ID 4797

Operating Systems Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Account Management
 • User Account Management
Type Success
Corresponding events
in Windows 2003
and before

4797: An attempt was made to query the existence of a blank password for an account

On this page

There is a lot of confusion about this event and no good explanation. If you see this event for many different target account names I would investigate. Or if you see this event on many different systems where caller workstation name is the same. Otherwise ignore.

More: This event is worthless. I just set up a new Windows 10 VM, installed one very safe piece of software on it, and logged on as a non-admin user. After logon, that user, according to the security log, queried the existence of a blank password for every local account on the system. I'm certain the system is clean of malware. If this event at least included the process that made the request we'd have a chance of tracking down what is causing it but all you get is the target account and who did it.

Free Security Log Resources by Randy

Supercharger Free Edition

Your entire Windows Event Collection environment on a single pane of glass.



Examples of 4797

An attempt was made to query the existence of a blank password for an account.

    Security ID:    %1
    Account Name:   %2
    Account Domain: %3
    Logon ID:       %4

Additional Information:
    Caller Workstation:    %5
    Target Account Name:   %6
    Target Account Domain: %7

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources