Event ID 4743
A computer account was deletedA computer account was deleted.
Subject:
Security ID: %4
Account Name: %5
Account Domain: %6
Logon ID: %7
Target Computer:
Security ID: %3
Account Name: %1
Account Domain: %2
Additional Information:
Privileges: %8This event generates every time a computer object is successfully deleted. There is no event logged when a computer object was attempted to be deleted but was unsuccessful.
Auditing:
Always
Keeps track of who deleted a computer account when.
Volume:
Low
Microsoft Documentation
| Name | Field | Insertion String | OS | Example | ||
|---|---|---|---|---|---|---|
| Account Name | TargetUserName | %1 | Any | COMPUTERACCOUNT$ | ||
| Account Domain | TargetDomainName | %2 | Any | DOMAIN | ||
| Security ID | TargetSid | %3 | Any | S-1-5-21-3457937927-2839227994-823803824-6118 | ||
| Security ID | SubjectUserSid | %4 | Any | DOMAIN\TheAdmin | ||
| Account Name | SubjectUserName | %5 | Any | TheAdmin | ||
| Account Domain | SubjectDomainName | %6 | Any | DOMAIN | ||
| Logon ID | SubjectLogonId | %7 | Any | 0x3007b | ||
| Privileges | PrivilegeList | %8 | Any | View Codes | ||
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Computer Account Management"
LEFT/RIGHT arrow keys for navigation
Back to List