Event ID: 4794

SID of account that made an attempt to set Directory Services Restore Mode administrator password. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.

The name of the account that made an attempt to set Directory Services Restore Mode administrator password.

"Subject’s domain or computer name. Formats vary, and include the following:

Domain NETBIOS name example: DOMAIN

Lowercase full domain name: domain.local

Uppercase full domain name: DOMAIN.LOCAL

For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.

For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “ComputerName”."

Hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “4624: An account was successfully logged on.”

The name of computer account from which Directory Services Restore Mode (DSRM) administrator password change request was received. For example: “DC01”. If the change request was sent locally (from the same server) this field will have the same name as the computer account.

0x0 indicates success.