Event ID 4781
The name of an account was changedThe name of an account was changed:
Subject:
Security ID: %5
Account Name: %6
Account Domain: %7
Logon ID: %8
Target Account:
Security ID: %4
Account Domain: %3
Old Account Name: %1
New Account Name: %2
Additional Information:
Privileges: %9This event generates every time a user or computer account name (sAMAccountName attribute) is changed.
For user accounts, this event generates on domain controllers, member servers, and workstations.
For computer accounts, this event generates only on domain controllers.
| Name | Field | Insertion String | OS | Example | |
|---|
| Old Account Name | OldTargetUserName | %1 | Any | Admin |
| New Account Name | NewTargetUserName | %2 | Any | MainAdmin |
| Account Domain | TargetDomainName | %3 | Any | DOMAIN |
| Security ID | TargetSid | %4 | Any | S-1-5-21-3457937927-2839227994-823803824-6117 |
| Security ID | SubjectUserSid | %5 | Any | S-1-5-21-3457937927-2839227994-823803824-1104 |
| Account Name | SubjectUserName | %6 | Any | dadmin |
| Account Domain | SubjectDomainName | %7 | Any | DOMAIN |
| Logon ID | SubjectLogonId | %8 | Any | 0x30d5f |
| Privileges | PrivilegeList | %9 | Any | - |
Old name of target account.
New name of target account.
"Subject’s domain or computer name. Formats vary, and include the following:
Domain NETBIOS name example: DOMAIN
Lowercase full domain name: domain.local
Uppercase full domain name: DOMAIN.LOCAL
For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “ComputerName”."
SID of account on which the name was changed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
SID of account that performed the “change account name” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
The name of the account that performed the “change account name” operation.
"Subject’s domain or computer name. Formats vary, and include the following:
Domain NETBIOS name example: DOMAIN
Lowercase full domain name: domain.local
Uppercase full domain name: DOMAIN.LOCAL
For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “ComputerName”."
Hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “4624: An account was successfully logged on.”
The list of user privileges which were used during the operation, for example, SeBackupPrivilege. This parameter might not be captured in the event, and in that case appears as “-”
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"User Account Management"
LEFT/RIGHT arrow keys for navigation
Back to List