#account-management

Windows Event ID 4781 – Security: Account Name Changed

Event ID 4781 records when a user account name is changed in Active Directory or local SAM database. Critical for security auditing and compliance tracking.

Windows Event ID 4700 – Security: A User Account was Created

Event ID 4700 records when a new user account is created on a Windows system. This security audit event provides detailed information about who created the account, when it was created, and the account properties configured during creation.

Windows Event ID 4767 – Microsoft-Windows-Security-Auditing: User Account Unlocked

Event ID 4767 fires when a user account is unlocked by an administrator or automatically by the system after the lockout duration expires.

Windows Event ID 4763 – Microsoft-Windows-Security-Auditing: User Account Deleted

Event ID 4763 fires when a user account is deleted from Active Directory or local computer. This security audit event tracks account deletion activities for compliance and security monitoring purposes.

Windows Event ID 4762 – Security: User Account Enabled

Event ID 4762 logs when a user account is enabled in Active Directory or local security database. This security audit event tracks account state changes for compliance and monitoring purposes.

Windows Event ID 4760 – Microsoft-Windows-Security-Auditing: User Account Deleted

Event ID 4760 fires when a user account is deleted from Active Directory or local system. This security audit event tracks account deletion operations for compliance and security monitoring purposes.

Windows Event ID 4759 – Microsoft-Windows-Security-Auditing: User Account Deleted

Event ID 4759 fires when a user account is deleted from the local Security Accounts Manager (SAM) database, providing audit trail for account management activities.

Windows Event ID 4758 – Microsoft-Windows-Security-Auditing: User Account Enabled

Event ID 4758 fires when a user account is enabled in Active Directory or local SAM database. This security audit event tracks account state changes for compliance and security monitoring purposes.

Windows Event ID 4755 – Security: User Account Enabled

Event ID 4755 logs when a user account is enabled in Active Directory or local security database. This security audit event tracks account management activities for compliance and monitoring purposes.

Windows Event ID 4726 – Microsoft-Windows-Security-Auditing: User Account Deleted

Event ID 4726 fires when a user account is deleted from Active Directory or local system. Critical security event for tracking account lifecycle and potential unauthorized deletions.

Windows Event ID 4725 – Microsoft-Windows-Security-Auditing: User Account Disabled

Event ID 4725 fires when a user account is disabled in Active Directory or on a local Windows system, providing audit trail for account management activities.

Windows Event ID 4722 – Microsoft-Windows-Security-Auditing: User Account Enabled

Event ID 4722 fires when a user account is enabled in Active Directory or local SAM database. Critical for security auditing and tracking account state changes.