Windows Event ID 4739 – Microsoft-Windows-Security-Auditing: User Account Changed

Open Event Viewer and navigate to Windows Logs → Security to examine Event ID 4739 details.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Expand Windows Logs and click Security
3. Right-click the Security log and select Filter Current Log
4. Enter 4739 in the Event IDs field and click OK
5. Double-click any Event ID 4739 entry to view detailed information
6. Review the General tab for account names, timestamps, and change details
7. Check the Details tab for raw XML data including specific attribute changes

Key fields to examine include Subject (who made the change), Target Account (account being modified), and Changed Attributes listing specific properties that were altered.

Use PowerShell to filter and analyze Event ID 4739 occurrences with specific criteria.

# Get recent user account change events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4739} -MaxEvents 50 | 
    Select-Object TimeCreated, Id, LevelDisplayName, Message

# Filter events for specific user account
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4739}
$Events | Where-Object {$_.Message -like '*john.doe*'} | 
    Format-Table TimeCreated, Message -Wrap

# Export events to CSV for analysis
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4739} -MaxEvents 1000 | 
    Select-Object TimeCreated, Id, LevelDisplayName, 
    @{Name='User';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Account Name:*'})[0]}}, 
    @{Name='Changes';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Changed Attributes:*'})[0]}} | 
    Export-Csv -Path "C:\Temp\UserAccountChanges.csv" -NoTypeInformation

This approach provides programmatic access to event data for automated analysis and reporting.

Ensure proper audit policy configuration to capture comprehensive user account change events.

1. Open Group Policy Management Console or run gpedit.msc for local policy
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Account Management and double-click Audit User Account Management
4. Enable Configure the following audit events and check both Success and Failure
5. Apply the policy and run gpupdate /force to refresh settings

# Verify current audit policy settings
auditpol /get /subcategory:"User Account Management"

# Enable user account management auditing via command line
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

# Check audit policy effectiveness
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4739} -MaxEvents 1 | 
    Select-Object TimeCreated, Message

Proper audit configuration ensures all user account modifications generate Event ID 4739 entries for compliance and security monitoring.

Create PowerShell scripts to parse and analyze specific attribute changes from Event ID 4739 messages.

# Function to parse Event ID 4739 attribute changes
function Parse-UserAccountChanges {
    param([int]$Days = 7)
    
    $Events = Get-WinEvent -FilterHashtable @{
        LogName='Security'
        Id=4739
        StartTime=(Get-Date).AddDays(-$Days)
    }
    
    foreach ($Event in $Events) {
        $Message = $Event.Message
        $Lines = $Message -split '\r?\n'
        
        $AccountName = ($Lines | Where-Object {$_ -match 'Account Name:\s*(.+)'}) -replace '.*Account Name:\s*', ''
        $SubjectName = ($Lines | Where-Object {$_ -match 'Subject.*Account Name:\s*(.+)'}) -replace '.*Account Name:\s*', ''
        $ChangedAttribs = ($Lines | Where-Object {$_ -match 'Changed Attributes:'}) -replace '.*Changed Attributes:\s*', ''
        
        [PSCustomObject]@{
            TimeCreated = $Event.TimeCreated
            ModifiedAccount = $AccountName
            ModifiedBy = $SubjectName
            ChangedAttributes = $ChangedAttribs
            EventId = $Event.Id
        }
    }
}

# Run the analysis
$Changes = Parse-UserAccountChanges -Days 30
$Changes | Format-Table -AutoSize

# Group by modified account to see patterns
$Changes | Group-Object ModifiedAccount | 
    Select-Object Name, Count, @{Name='LastChange';Expression={($_.Group | Sort-Object TimeCreated -Descending)[0].TimeCreated}}

This method provides detailed analysis capabilities for forensic investigation and compliance reporting.

Configure Windows Event Forwarding and SIEM integration for centralized monitoring of user account changes.

1. Configure Windows Event Forwarding on domain controllers and member servers
2. Create custom event forwarding subscription for Event ID 4739
3. Set up SIEM parsing rules for user account change events

# Configure WinRM for event forwarding (run on collector server)
winrm quickconfig
wecutil qc

# Create event subscription XML file
$SubscriptionXML = @'
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>UserAccountChanges</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Forward user account change events</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <ConfigurationMode>Normal</ConfigurationMode>
    <Query>
        <![CDATA[
        <QueryList>
            <Query Id="0">
                <Select Path="Security">*[System[EventID=4739]]</Select>
            </Query>
        </QueryList>
        ]]>
    </Query>
</Subscription>
'@

# Save and create subscription
$SubscriptionXML | Out-File -FilePath "C:\Temp\UserAccountChanges.xml"
wecutil cs "C:\Temp\UserAccountChanges.xml"

# Verify subscription status
wecutil gs UserAccountChanges

Enterprise environments should implement centralized logging with automated alerting for suspicious user account modifications, especially privilege escalations or bulk changes.