Windows Event ID 4742 – Microsoft-Windows-Security-Auditing: Computer Account Changed

Start by examining the specific event details to understand what changed and who initiated the modification.

1. Open Event Viewer on the domain controller where the event occurred
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4742 using the filter option or search functionality
4. Double-click the event to view detailed information including:
   • Subject fields showing who made the change
   • Computer Account fields identifying the target computer
   • Changed Attributes section listing modified properties
5. Note the timestamp, source workstation, and logon type for correlation

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4742} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Use PowerShell to extract and analyze computer account modification patterns across your domain controllers.

1. Query events from multiple domain controllers to get a complete picture:

$DCs = Get-ADDomainController -Filter *
$Events = @()
foreach ($DC in $DCs) {
    $Events += Get-WinEvent -ComputerName $DC.Name -FilterHashtable @{LogName='Security'; Id=4742; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
}
$Events | Select-Object TimeCreated, MachineName, @{Name='ComputerAccount';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Account Name:*'})[1] -replace '.*Account Name:\s*',''}}

2. Filter events by specific computer accounts or time ranges:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4742; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Message -like '*COMPUTER01*'} | Format-List TimeCreated, Message

3. Export events for further analysis or compliance reporting:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4742; StartTime=(Get-Date).AddDays(-30)} | Export-Csv -Path "C:\Temp\ComputerAccountChanges.csv" -NoTypeInformation

Cross-reference Event ID 4742 with Active Directory replication events and other security logs to understand the full context of computer account modifications.

1. Check for related events that might indicate the source of changes:

# Look for related logon events from the same user
$UserSID = "S-1-5-21-..."
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648; StartTime=(Get-Date).AddHours(-2)} | Where-Object {$_.Message -like "*$UserSID*"}

2. Verify computer account status in Active Directory:

Get-ADComputer -Identity "COMPUTER01" -Properties * | Select-Object Name, Enabled, LastLogonDate, PasswordLastSet, MemberOf

3. Check for Group Policy processing that might trigger computer account changes:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} -MaxEvents 20 | Where-Object {$_.Message -like '*COMPUTER01*'}

4. Review Directory Service event logs for replication issues:

Get-WinEvent -FilterHashtable @{LogName='Directory Service'; Id=1644,1645} -MaxEvents 10

Set up comprehensive monitoring for computer account changes to detect unauthorized modifications and maintain security compliance.

1. Create a custom Event Viewer view for computer account monitoring:
2. Open Event Viewer → Custom Views → Create Custom View
3. Configure filter criteria:
   • Event logs: Security
   • Event IDs: 4742
   • Keywords: Audit Success
4. Save as "Computer Account Changes"

2. Set up PowerShell-based monitoring script:

# Monitor for suspicious computer account changes
$LastCheck = (Get-Date).AddMinutes(-15)
$SuspiciousEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4742; StartTime=$LastCheck} | Where-Object {
    $_.Message -notlike '*SYSTEM*' -and 
    $_.Message -like '*Account Name:*' -and
    ($_.Message -like '*Enabled*' -or $_.Message -like '*Group*')
}

if ($SuspiciousEvents) {
    $SuspiciousEvents | ForEach-Object {
        Send-MailMessage -To "admin@company.com" -From "monitoring@company.com" -Subject "Suspicious Computer Account Change" -Body $_.Message -SmtpServer "mail.company.com"
    }
}

3. Configure Windows Event Forwarding for centralized monitoring:
4. On collector server, run: wecutil qc
5. Create subscription configuration file:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>ComputerAccountChanges</SubscriptionId>
    <Query>
        <Select Path="Security">*[System[EventID=4742]]</Select>
    </Query>
</Subscription>

4. Import the subscription: wecutil cs subscription.xml

Perform detailed forensic analysis of computer account changes for security investigations and compliance auditing.

1. Extract detailed event information for forensic analysis:

# Create detailed forensic report
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4742; StartTime=(Get-Date).AddDays(-90)}
$Report = @()

foreach ($Event in $Events) {
    $XML = [xml]$Event.ToXml()
    $EventData = @{}
    $XML.Event.EventData.Data | ForEach-Object {
        $EventData[$_.Name] = $_.'#text'
    }
    
    $Report += [PSCustomObject]@{
        TimeCreated = $Event.TimeCreated
        SubjectUserName = $EventData.SubjectUserName
        SubjectDomainName = $EventData.SubjectDomainName
        TargetUserName = $EventData.TargetUserName
        TargetDomainName = $EventData.TargetDomainName
        ChangedAttributes = ($XML.Event.EventData.Data | Where-Object {$_.Name -like '*Changed*'} | ForEach-Object {$_.'#text'}) -join '; '
    }
}

$Report | Export-Csv -Path "C:\Forensics\ComputerAccountChanges_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

2. Analyze patterns and anomalies:

# Identify unusual modification patterns
$Report | Group-Object SubjectUserName | Sort-Object Count -Descending | Select-Object Name, Count
$Report | Group-Object TargetUserName | Sort-Object Count -Descending | Select-Object Name, Count

3. Generate compliance reports with specific timeframes:

# Monthly compliance report
$StartDate = (Get-Date).AddDays(-30)
$ComplianceReport = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4742; StartTime=$StartDate} | 
    Select-Object TimeCreated, @{Name='ModifiedBy';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Subject:*'} | Select-Object -Skip 1 -First 1) -replace '.*Account Name:\s*',''}}, 
    @{Name='ComputerModified';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Computer Account:*'} | Select-Object -Skip 1 -First 1) -replace '.*Account Name:\s*',''}}

$ComplianceReport | Export-Csv -Path "C:\Compliance\Monthly_Computer_Changes_$(Get-Date -Format 'yyyy-MM').csv" -NoTypeInformation