Event ID 4830
SID History was removed from an accountSID History was removed from an account. Subject: Security ID: %6 Account Name: %7 Account Domain: %8 Logon ID: %9 Target Account: Security ID: %5 Account Name: %3 Account Domain: %4 Additional Information: Privileges: %10 SID List: %11
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:System
Audit Category:
SystemLEFT/RIGHT arrow keys for navigation
Back to List