Windows Security Log Event ID 645

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryAccount Management
Type Success
Corresponding events
in Windows 2008
and Vista
4741  
Discussions on Event ID 645
Ask a question about this event

645: Computer Account Created

On this page

"Caller" user created a new computer account. Note that internally Windows appends a $ to all computer account names and this is reflected in other events where computer account names are listed.

Free Security Log Resources by Randy

Description Fields in 645

  • New Account Name: %1
  • New Domain: %2
  • New Account ID: %3
  • Caller User Name: %4
  • Caller Domain: %5
  • Caller Logon ID: %6
  • Privileges  %7
  • Attributes:
  • Sam Account Name: %8
  • Display Name: %9
  • User Principal Name: %10
  • Home Directory: %11
  • Home Drive: %12
  • Script Path: %13
  • Profile Path: %14
  • User Workstations: %15
  • Password Last Set: %16
  • Account Expires: %17
  • Primary Group ID: %18
  • AllowedToDelegateTo: %19
  • Old UAC Value: %20
  • New UAC Value: %21
  • User Account Control: %22
  • User Parameters: %23
  • Sid History: %24
  • Logon Hours: %25
  • DNS Host Name: %26
  • Service Principal Names: %27

Supercharger Free Edition

 

Examples of 645

Computer Account Created:
New Account Name:COMP1$
New Domain:ELMW2
New Account ID:comp1
DEL:30f31309-cd32-4171-aad9-be7ddbfd04fe
Caller User Name:Administrator
Caller Domain:ELMW2
Caller Logon ID:(0x0,0x12D622)
Privileges-
Windows Server 2003 adds these fields
Attributes:
Sam Account Name:FILESERVER12$
Display Name:-
User Principal Name:-
Home Directory:-
Home Drive:-
Script Path:-
Profile Path:-
User Workstations:-
Password Last Set:

Account Expires:

Primary Group ID:515
AllowedToDelegateTo:-
Old UAC Value:0x0
New UAC Value:0x85
User Account Control:
Account Disabled
'Password Not Required' - Enabled
'Workstation Trust Account' - Enabled
User Parameters:-
Sid History:-
Logon Hours:

DNS Host Name:-
Service Principal Names:-

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources