WinSecWiki > Security Settings > Local Policies > Audit Policy > Account Management > User Account

User Account Management

This category tracks changes to local user accounts on workstations, member servers and Active Directory domain user accounts on domain controllers. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4720	A user account was created.
4722	A user account was enabled.
4723	An attempt was made to change an account's password.
4724	An attempt was made to reset an accounts password.
4725	A user account was disabled.
4726	A user account was deleted.
4738	A user account was changed.
4740	A user account was locked out.
4767	A user account was unlocked.
4780	The ACL was set on accounts which are members of administrators groups.
4781	The name of an account was changed:
4794	An attempt was made to set the Directory Services Restore Mode administrator password
5376	Credential Manager credentials were backed up.
5377	Credential Manager credentials were restored from a backup.

Back to top

 

Upcoming Webinars Identifying the Tier 0 Assets in Your Active Directory Environment is Step #1 in ITDR

Additional Resources