IT Toolbox
IT Toolbox

Event ID 4738 — Change of user account

TopicWindows Server →
View my favorites

One or more attributes of a user account have been changed….

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

  • Normal administrative change….
  • UPN modification or account settings….
  • Unplanned alteration…

Verifications to be carried out

  1. Compare Attributes Changed Attributes….
  2. Identify the author….
  3. Correlate with a change request….

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4738} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.

♡ 0