Windows Event ID 4747 – Security: Computer Account Password Changed

Start by examining the specific details of the Event ID 4747 occurrence to understand the context and legitimacy of the password change.

1. Open Event Viewer on the domain controller where the event occurred
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4747 using the filter option
4. Double-click the event to view detailed information
5. Review the following key fields:
   • Subject: Account that initiated the password change
   • Target Account: Computer account that was modified
   • Logon ID: Session identifier for correlation
   • Process Information: Application or service that performed the change
6. Check the timestamp to correlate with known administrative activities or automatic processes
7. Verify if the initiating account has appropriate permissions for computer account management

Use PowerShell to efficiently query and analyze Event ID 4747 occurrences across multiple domain controllers for comprehensive monitoring.

1. Open PowerShell as Administrator on a domain controller or management workstation
2. Query recent Event ID 4747 occurrences:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4747} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events for specific computer accounts:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4747} | Where-Object {$_.Message -like '*COMPUTERNAME*'} | Format-Table TimeCreated, Message -Wrap

4. Query events from multiple domain controllers:

   $DCs = Get-ADDomainController -Filter *
   foreach ($DC in $DCs) {
       Write-Host "Checking $($DC.Name)..."
       Get-WinEvent -ComputerName $DC.Name -FilterHashtable @{LogName='Security'; Id=4747; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
   }

5. Export results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4747; StartTime=(Get-Date).AddDays(-30)} | Export-Csv -Path "C:\Temp\Event4747_Analysis.csv" -NoTypeInformation

Investigate the affected computer account's current status and domain trust relationship to determine if the password change was legitimate and successful.

1. Open Active Directory Users and Computers on a domain controller
2. Navigate to the Computers container or appropriate OU
3. Locate the computer account mentioned in the Event ID 4747
4. Right-click the computer account and select Properties
5. Check the Account tab for:
   • Account options and restrictions
   • Last logon timestamp
   • Account expiration settings
6. Verify trust relationship using PowerShell:

   Test-ComputerSecureChannel -Server DC01.domain.com -Verbose

7. Check computer account password age:

   Get-ADComputer -Identity "COMPUTERNAME" -Properties PasswordLastSet | Select-Object Name, PasswordLastSet

8. If trust issues exist, reset the computer account:

   Reset-ComputerMachinePassword -Server DC01.domain.com -Credential (Get-Credential)

Review audit policy configuration and correlate Event ID 4747 with related security events to understand the complete context of computer account changes.

1. Verify audit policy settings on domain controllers:

   auditpol /get /subcategory:"Computer Account Management"

2. Check Group Policy audit configuration:
   • Open Group Policy Management Console
   • Navigate to Default Domain Controllers Policy
   • Go to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Verify Account Management → Audit Computer Account Management is enabled
3. Query related events for correlation:

   # Check for related computer account events
   $Events = @(4741, 4742, 4743, 4747)
   foreach ($EventID in $Events) {
       Write-Host "Event ID $EventID occurrences:"
       (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$EventID; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue).Count
   }

4. Create a comprehensive audit report:

   $StartTime = (Get-Date).AddDays(-7)
   $ComputerEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=@(4741,4742,4743,4747); StartTime=$StartTime}
   $ComputerEvents | Group-Object Id | Select-Object Name, Count | Sort-Object Count -Descending

Set up comprehensive monitoring and alerting for Event ID 4747 to proactively detect unusual computer account password change patterns and potential security issues.

1. Create a custom Event Viewer view for computer account monitoring:
   • Open Event Viewer and right-click Custom Views
   • Select Create Custom View
   • Set Event level to Information and Event IDs to 4741,4742,4743,4747
   • Name the view "Computer Account Management"
2. Configure Windows Event Forwarding for centralized monitoring:

   # On collector server
   wecutil qc
   # Create subscription
   wecutil cs ComputerAccountEvents.xml

3. Set up PowerShell-based monitoring script:

   # Monitor for unusual password change frequency
   $Threshold = 5 # More than 5 changes per hour
   $RecentEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4747; StartTime=(Get-Date).AddHours(-1)}
   if ($RecentEvents.Count -gt $Threshold) {
       Send-MailMessage -To "admin@company.com" -Subject "High Computer Account Password Changes" -Body "Detected $($RecentEvents.Count) password changes in the last hour"
   }

4. Configure registry settings for enhanced logging:

   # Enable detailed computer account logging
   Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "MaxSize" -Value 1073741824

5. Create scheduled task for regular monitoring:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\MonitorEvent4747.ps1"
   $Trigger = New-ScheduledTaskTrigger -Daily -At "09:00"
   Register-ScheduledTask -TaskName "Monitor Computer Account Changes" -Action $Action -Trigger $Trigger -RunLevel Highest