WinSecWiki > Security Settings > Local Policies > Audit Policy > Account Management > User Account

User Account Management

This category tracks changes to local user accounts on workstations, member servers and Active Directory domain user accounts on domain controllers. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID Title
4720 A user account was created.
4722 A user account was enabled.
4723 An attempt was made to change an account's password.
4724 An attempt was made to reset an accounts password.
4725 A user account was disabled.
4726 A user account was deleted.
4738 A user account was changed.
4740 A user account was locked out.
4767 A user account was unlocked.
4780 The ACL was set on accounts which are members of administrators groups.
4781 The name of an account was changed:
4794 An attempt was made to set the Directory Services Restore Mode administrator password
5376 Credential Manager credentials were backed up.
5377 Credential Manager credentials were restored from a backup.

Back to top


Additional Resources