Event ID: 4797

An attempt was made to query the existence of a blank password for an account

An attempt was made to query the existence of a blank password for an account.

Subject:
    Security ID:    %1
    Account Name:   %2
    Account Domain: %3
    Logon ID:       %4

Additional Information:
    Caller Workstation:    %5
    Target Account Name:   %6
    Target Account Domain: %7



Name Field Insertion String OS Example
Security ID SubjectUserSid %1 Any S-1-5-19
Account Name SubjectUserName %2 Any LOCAL SERVICE
Account Domain SubjectDomainName %3 Any NT AUTHORITY
Logon ID SubjectLogonId %4 Any 0x3e5
Caller Workstation Workstation %5 Any WIN10-CLIENT
Target Account Name TargetUserName %6 Any Administrator
Target Account Domain TargetDomainName %7 Any WIN10-CLIENT


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"User Account Management"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List