Event ID: 4782

The password hash an account was accessed

The password hash an account was accessed.

    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:       %6

Target Account:
    Account Name:       %1
    Account Domain:     %2

This event generates on domain controllers during password migration of an account using Active Directory Migration Toolkit.

Typically “Subject\Security ID” is the SYSTEM account.

Auditing:     Always

Monitor for all events of this type, because any actions with account’s password hashes should be planned. If this action was not planned, investigate the reason for the change.

Volume:     Low

Microsoft Documentation

Event ID - 4782

Name Field Insertion String OS Example
Account Name TargetUserName %1 Any bSmith
Account Domain TargetDomainName %2 Any DOMAIN
Security ID SubjectUserSid %3 Any SYSTEM
Account Name SubjectUserName %4 Any DC01$
Account Domain SubjectDomainName %5 Any DOMAIN

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Account Management Events"

LEFT/RIGHT arrow keys for navigation

Back to List