Windows event ID 4738 - A user account was changed

Event ID: 

4738

Category: 

Account Management

Subcategory: 

User Account Management

Supported on: 

Windows Vista, Windows Server 2008

A user account was changed.

Subject:
Security ID: %5
Account Name: %6
Account Domain: %7
Logon ID: %8

Target Account:
Security ID: %4
Account Name: %2
Account Domain: %3

Changed Attributes:
SAM Account Name: %10
Display Name: %11
User Principal Name: %12
Home Directory: %13
Home Drive: %14
Script Path: %15
Profile Path: %16
User Workstations: %17
Password Last Set: %18
Account Expires: %19
Primary Group ID: %20
AllowedToDelegateTo: %21
Old UAC Value: %22
New UAC Value: %23
User Account Control: %24
User Parameters: %25
SID History: %26
Logon Hours: %27

Additional Information:
Privileges: %9

Related content