#event-id-4738

1 article

Windows Events1

Windows Event Viewer displaying security audit logs with Event ID 4738 user account modification events on a SOC monitoring dashboard

Event 4738

Microsoft-Windows-Security-Auditing

Windows EventInformation

Windows Event ID 4738 – Microsoft-Windows-Security-Auditing: User Account Changed

Event ID 4738 fires when a user account is modified in Active Directory or local SAM database. Critical for security auditing and tracking unauthorized account changes.

March 1812 min