Event ID 4742

This event generates every time a computer object is changed.

You might see the same values for Subject\Security ID and Computer Account That Was Changed\Security ID in this event. This usually happens when you reboot a computer after adding it to the domain (the change takes effect after the reboot).

For each change, a separate 4742 event will be generated.

Some changes do not invoke a 4742 event, for example, changes made using Active Directory Users and Computers management console in Managed By tab in computer account properties.

You might see this event without any changes inside, that is, where all Changed Attributes apear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, this would happen if you change the Description of a group object using the Active Directory Users and Computers administrative console. Also, if the discretionary access control list (DACL) is changed, a 4742 event will generate, but all attributes will be “-“.

Important: If you manually change any user-related setting or attribute, for example if you set the SMARTCARD_REQUIRED flag in userAccountControl for the computer account, then the sAMAccountType of the computer account will be changed to NORMAL_USER_ACCOUNT and you will get “4738: A user account was changed” instead of 4742 for this computer account. Essentially, the computer account will “become” a user account. For NORMAL_USER_ACCOUNT you will always get events from Audit User Account Management subcategory. We strongly recommend that you avoid changing any user-related settings manually for computer objects.