Windows Security Log Event ID 646

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryAccount Management
Type Success
Corresponding events
in Windows 2008
and Vista
4742  

646: Computer Account Changed

On this page

"Target" computer account was changed by "Caller" user. For some types of changes the event will include a description of what was changed on the 2nd line of the description.

Free Security Log Resources by Randy

Description Fields in 646

  • Computer Account Changed: %1
  • Target Account Name: %2 (A computer account is always followed by a "$".) 
  • Target Domain: %3
  • Target Account ID: %4
  • Caller User Name: %5
  • Caller Domain: %6
  • Caller Logon ID: %7
  • Privileges: %8
  • Changed Attributes: (The following events appear in Server 2003 only)
  • Sam Account Name: %9
  • Display Name: %10
  • User Principal Name: %11
  • Home Directory: %12
  • Home Drive: %13
  • Script Path: %14
  • Profile Path: %15
  • User Workstations: %16
  • Password Last Set: %17
  • Account Expires: %18
  • Primary Group ID: %19
  • AllowedToDelegateTo: %20
  • Old UAC Value: %21
  • New UAC Value: %22
  • User Account Control: %23
  • User Parameters: %24
  • Sid History: %25
  • Logon Hours: %26
  • DNS Host Name: %27
  • Service Principal Names: %28

Supercharger Free Edition


Your entire Windows Event Collection environment on a single pane of glass.

Free.

 

Examples of 646

Computer Account Changed:
Account Enabled.
Target Account Name:COMP1$
Target Domain:ELMW2
Target Account ID:comp1
DEL:30f31309-cd32-4171-aad9-be7ddbfd04fe
Caller User Name:Administrator
Caller Domain:ELMW2
Caller Logon ID:(0x0,0x12D622)
Privileges:-

Windows Server 2003 adds these fields
Changed Attributes:
Sam Account Name:-
Display Name:-
User Principal Name:-
Home Directory:-
Home Drive:-
Script Path:-
Profile Path:-
User Workstations:-
Password Last Set:-
Account Expires:-
Primary Group ID:-
AllowedToDelegateTo:-
Old UAC Value:-
New UAC Value:-
User Account Control:-
User Parameters:-
Sid History:-
Logon Hours:-
DNS Host Name:-
Service Principal Names:-

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources