Windows event ID 4780 - The ACL was set on accounts which are members of administrators groups

Event ID: 

4780

Category: 

Account Management

Subcategory: 

User Account Management

Supported on: 

Windows Vista, Windows Server 2008

The ACL was set on accounts which are members of administrators groups.


Subject:
Security ID: %4
Account Name: %5
Account Domain: %6
Logon ID: %7

Target Account:
Security ID: %3
Account Name: %1
Account Domain: %2

Additional Information:
Privileges: %8

Every hour, the Windows domain controller that holds the primary domain controller (PDC) Flexible Single Master Operation (FSMO) role compares the ACL on all security principal accounts (users, groups, and machine accounts) present for its domain in Active Directory and that are in administrative groups against the ACL on the AdminSDHolder object. If the ACL on the principal account differs from the ACL on the AdminSDHolder object, then the ACL on the principal account is reset to match the ACL on the AdminSDHolder object and this event is generated.

Related content