Event ID: 4782

The password hash an account was accessed

The password hash an account was accessed.

    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:       %6

Target Account:
    Account Name:       %1
    Account Domain:     %2

This event generates on domain controllers during password migration of an account using Active Directory Migration Toolkit.

Typically “Subject\Security ID” is the SYSTEM account.

Auditing:     Always

Volume:     Low

Microsoft Documentation

Event ID - 4782

Name Field Insertion String OS Example
Account Name TargetUserName %1 Any UserName
Account Domain TargetDomainName %2 Any DOMAIN
Security ID SubjectUserSid %3 Any S-1-5-18
Account Name SubjectUserName %4 Any DC01$
Account Domain SubjectDomainName %5 Any DOMAIN

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Account Management Events"

LEFT/RIGHT arrow keys for navigation

Back to List