Event ID 4742: A computer account was changed
Written on domain controllers when a computer account's attributes change.
- Log
- Security
- Category
- Account management
Why it matters
- Changes to delegation settings or service principal names on computer accounts can enable privilege escalation.
What to check
Check which attributes changed and who changed them.
How to turn it on
Advanced Audit Policy: Account Management > Audit Computer Account Management.
MITRE ATT&CK
- T1098 Account Manipulation