Windows Event ID 4738 – Microsoft-Windows-Security-Auditing: User Account Changed

Start by examining the specific details of the 4738 event to understand what changed and who initiated the modification.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4738 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4738 in the Event IDs field and click OK
5. Double-click on a 4738 event to view detailed information including:
   • Subject: Account that made the change
   • Target Account: Account that was modified
   • Changed Attributes: Specific fields that were altered
   • Additional Information: Workstation and process details

Use PowerShell to efficiently search and analyze 4738 events across multiple systems or time ranges.

1. Open PowerShell as Administrator
2. Query recent 4738 events with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4738} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Search for specific user account modifications:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4738; StartTime=(Get-Date).AddDays(-7)}
   $Events | Where-Object {$_.Message -like '*username*'} | Select-Object TimeCreated, Message

4. Extract detailed information from event properties:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4738} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $Event.Event.EventData.Data[1].'#text'
           TargetUserName = $Event.Event.EventData.Data[5].'#text'
           TargetDomain = $Event.Event.Event.EventData.Data[6].'#text'
           WorkstationName = $Event.Event.EventData.Data[11].'#text'
       }
   }

Ensure proper audit policy configuration to capture all necessary account modification events.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Account Management and configure these policies:
   • Audit User Account Management: Set to Success and Failure
   • Audit Security Group Management: Set to Success and Failure
   • Audit Distribution Group Management: Set to Success
4. Apply the policy using command line:

   auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
   auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

5. Verify current audit settings:

   auditpol /get /subcategory:"User Account Management"

6. Force Group Policy update if using domain policies:

   gpupdate /force

Perform detailed forensic analysis when 4738 events indicate potential security incidents.

1. Identify the source of suspicious changes by examining the Subject fields in the event:

   $SuspiciousEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4738; StartTime=(Get-Date).AddHours(-24)}
   $SuspiciousEvents | Where-Object {$_.Message -match 'Administrator|SYSTEM'} | ForEach-Object {
       $Event = [xml]$_.ToXml()
       Write-Host "Time: $($_.TimeCreated)"
       Write-Host "Subject: $($Event.Event.EventData.Data[1].'#text')"
       Write-Host "Target: $($Event.Event.EventData.Data[5].'#text')"
       Write-Host "Workstation: $($Event.Event.EventData.Data[11].'#text')"
       Write-Host "---"
   }

2. Cross-reference with logon events (4624) to verify legitimate access:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-2)} | Where-Object {$_.Message -like '*suspicious_username*'}

3. Check for related privilege escalation events (4672):

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=(Get-Date).AddHours(-2)} | Format-Table TimeCreated, Message -Wrap

4. Examine process creation events (4688) if available:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-2)} | Where-Object {$_.Message -like '*net.exe*' -or $_.Message -like '*dsmod*'}

5. Document findings and correlate with other security events for comprehensive incident analysis

Set up proactive monitoring to detect and respond to critical account modifications in real-time.

1. Create a PowerShell script for continuous monitoring:

   # Monitor4738.ps1
   $LastCheck = (Get-Date).AddMinutes(-5)
   while ($true) {
       $NewEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4738; StartTime=$LastCheck} -ErrorAction SilentlyContinue
       
       foreach ($Event in $NewEvents) {
           $EventXML = [xml]$Event.ToXml()
           $TargetUser = $EventXML.Event.EventData.Data[5].'#text'
           $SubjectUser = $EventXML.Event.EventData.Data[1].'#text'
           
           # Alert on privileged account changes
           if ($TargetUser -match 'admin|service|sql') {
               Write-Host "ALERT: Privileged account $TargetUser modified by $SubjectUser at $($Event.TimeCreated)" -ForegroundColor Red
               # Add email notification or SIEM integration here
           }
       }
       
       $LastCheck = Get-Date
       Start-Sleep -Seconds 300
   }

2. Configure Windows Event Forwarding for centralized collection:

   # On collector server
   wecutil qc /q
   wecutil cs subscription.xml

3. Create a custom Event Viewer view for 4738 monitoring:
   • Open Event Viewer → Custom Views
   • Right-click and select Create Custom View
   • Set Event IDs to 4738 and configure additional filters
   • Save as "User Account Changes Monitor"
4. Set up Task Scheduler for automated response:

   $Action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\Monitor4738.ps1'
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Principal = New-ScheduledTaskPrincipal -UserID 'SYSTEM' -LogonType ServiceAccount
   Register-ScheduledTask -TaskName 'Monitor4738Events' -Action $Action -Trigger $Trigger -Principal $Principal