Event ID: 4782

The password hash an account was accessed

The password hash an account was accessed.

Subject:
    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:       %6

Target Account:
    Account Name:       %1
    Account Domain:     %2
Microsoft Documentation

Event ID - 4782



This event generates on domain controllers during password migration of an account using Active Directory Migration Toolkit.

Typically “Subject\Security ID” is the SYSTEM account.



Name Field Insertion String OS Example
Account Name TargetUserName %1 Any UserName
Account Domain TargetDomainName %2 Any DOMAIN
Security ID SubjectUserSid %3 Any S-1-5-18
Account Name SubjectUserName %4 Any DC01$
Account Domain SubjectDomainName %5 Any DOMAIN


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Account Management Events"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List