Event ID 4738: A user account was changed
Written when account properties change: flags, password settings, logon hours, profile paths and more.
- Log
- Security
- Category
- Account management
Why it matters
- Watch for 'Don't Require Preauth' being set (opens AS-REP roasting) and 'Password never expires' on privileged accounts.
- Changes to the SID History attribute can be used to give an account hidden privileges.
What to check
Check which attributes changed (the event lists them), who changed them, and on which account.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1098 Account Manipulation