ID Event Description
4656 A handle to an object was requested
Audit Failure, Audit Success, CJIS
4659 A handle to an object was requested with intent to delete
4661 A handle to an object was requested
Domain Controller, Audit Success, Audit Failure
4672 Special privileges assigned to new logon
Audit Success
4673 A privileged service was called
Audit Success
4674 An operation was attempted on a privileged object
Audit Failure, Audit Success
4720 A user account was created
ISO 27001:2013, NIST SP 800-53, Audit Success, PCI-DSS, NIST 800-171, CMMC L1
4723 An attempt was made to change an account's password
Audit Success, Audit Failure, CJIS
4726 A user account was deleted
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, PCI-DSS, CMMC L1
4727 A security-enabled global group was created
Domain Controller
4728 A member was added to a security-enabled global group
Domain Controller, ISO 27001:2013, NIST 800-171, NIST SP 800-53, CMMC L1
4729 A member was removed from a security-enabled global group
Domain Controller
4730 A security-enabled global group was deleted
Domain Controller
4731 A security-enabled local group was created
Audit Success
4732 A member was added to a security-enabled local group
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, CMMC L1
4733 A member was removed from a security-enabled local group
Audit Success
4734 A security-enabled local group was deleted
Audit Success
4735 A security-enabled local group was changed
Audit Success
4737 A security-enabled global group was changed
Domain Controller
4738 A user account was changed
ISO 27001:2013, NIST 800-171, NIST SP 800-53, Audit Success, CMMC L1
4741 A computer account was created
Domain Controller, Audit Success
4742 A computer account was changed
Domain Controller, Audit Success
4743 A computer account was deleted
Domain Controller, Audit Success
4744 A security-disabled local group was created
4745 A security-disabled local group was changed
4746 A member was added to a security-disabled local group
4747 A member was removed from a security-disabled local group
4748 A security-disabled local group was deleted
4749 A security-disabled global group was created
Domain Controller, Audit Success
4750 A security-disabled global group was changed
Domain Controller, Audit Success
4751 A member was added to a security-disabled global group
Domain Controller, Audit Success
4752 A member was removed from a security-disabled global group
Domain Controller, Audit Success
4753 A security-disabled global group was deleted
Domain Controller, Audit Success
4754 A security-enabled universal group was created
Domain Controller
4755 A security-enabled universal group was changed
Domain Controller
4756 A member was added to a security-enabled universal group
Domain Controller, ISO 27001:2013
4757 A member was removed from a security-enabled universal group
Domain Controller
4758 A security-enabled universal group was deleted
Domain Controller
4759 A security-disabled universal group was created
Domain Controller
4760 A security-disabled universal group was changed
Domain Controller
4761 A member was added to a security-disabled universal group
Domain Controller
4762 A member was removed from a security-disabled universal group
Domain Controller
4763 A security-disabled universal group was deleted
Domain Controller
4764 A group’s type was changed
Domain Controller, Audit Success
4781 The name of an account was changed
Audit Success