Event ID 642
User Account ChangedUser Account Changed: Target Account Name: %2 Target Domain: %3 Target Account ID: %4 Caller User Name: %5 Caller Domain: %6 Caller Logon ID: %7 Privileges: %8 Changed Attributes: Sam Account Name: %9 Display Name: %10 User Principal Name: %11 Home Directory: %12 Home Drive: %13 Script Path: %14 Profile Path: %15 User Workstations: %16 Password Last Set: %17 Account Expires: %18 Primary Group ID: %19 AllowedToDelegateTo: %20 Old UAC Value: %21 New UAC Value: %22 User Account Control: %23 User Parameters: %24 Sid History: %25 Logon Hours: %26
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Account Management"
Audit Category:
Account ManagementLEFT/RIGHT arrow keys for navigation
Back to List