Event ID 4797

An attempt was made to query the existence of a blank password for an account

An attempt was made to query the existence of a blank password for an account.

Subject:
    Security ID:    %1
    Account Name:   %2
    Account Domain: %3
    Logon ID:       %4

Additional Information:
    Caller Workstation:    %5
    Target Account Name:   %6
    Target Account Domain: %7




NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any S-1-5-19
Account NameSubjectUserName%2Any LOCAL SERVICE
Account DomainSubjectDomainName%3Any NT AUTHORITY
Logon IDSubjectLogonId%4Any 0x3e5
Caller WorkstationWorkstation%5Any WIN10-CLIENT
Target Account NameTargetUserName%6Any Administrator
Target Account DomainTargetDomainName%7Any WIN10-CLIENT

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"User Account Management"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows VistaWindows 2008Windows 2008 R2Windows 7Windows 2012Windows 2012 R2Windows 8Windows 8.1Windows 10Windows 11Windows 2016Windows 2019Windows 2022Windows 2025

Audit Category:
Account Management

Audit Subcategory:
User Account Management

LEFT/RIGHT arrow keys for navigation

Back to List