| Event Id | 4738 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | A user account was changed. Subject: Security ID: <Security ID> Account Name: <Account Name> Account Domain: <Account Domain> Logon ID: <Logon ID> Target Account: Security ID: <Security ID> Account Name: <Account Name> Account Domain: <Account Domain> Changed Attributes: SAM Account Name: <SAM Account Name> Display Name: <Display Name> User Principal Name: <User Principal Name> Home Directory: <Home Directory> Home Drive: <Home Drive> Script Path: <Script Path> Profile Path: <Profile Path> User Workstations: <User Workstations> Password Last Set: <Password Last Set> Account Expires: <Account Expires> Primary Group ID: <Primary Group ID> AllowedToDelegateTo: <AllowedToDelegateTo> Old UAC Value: <Old UAC Value> New UAC Value: <New UAC Value> User Account Control: <User Account Control> User Parameters: <User Parameters> SID History: <SID History> Logon Hours: <Logon Hours> Additional Information: Privileges: <Privileges> |
| Event Information | Cause : This event is logged when user was changed in a user account . Resolution : This is an information event and no user action is required. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.