Event ID 646
Computer Account ChangedComputer Account Changed:
%1
Target Account Name: %2
Target Domain: %3
Target Account ID: %4
Caller User Name: %5
Caller Domain: %6
Caller Logon ID: %7
Privileges: %8
Changed Attributes:
Sam Account Name: %9
Display Name: %10
User Principal Name: %11
Home Directory: %12
Home Drive: %13
Script Path: %14
Profile Path: %15
User Workstations: %16
Password Last Set: %17
Account Expires: %18
Primary Group ID: %19
AllowedToDelegateTo: %20
Old UAC Value: %21
New UAC Value: %22
User Account Control: %23
User Parameters: %24
Sid History: %25
Logon Hours: %26
DNS Host Name: %27
Service Principal Names: %28Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Account Management"
Audit Category:
Account ManagementLEFT/RIGHT arrow keys for navigation
Back to List