Windows Event ID 4750 – Microsoft-Windows-Security-Auditing: Computer Account Password Changed

Open Event Viewer and navigate to the Security log to examine Event ID 4750 details:

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → Security
3. In the Actions pane, click Filter Current Log
4. Enter 4750 in the Event IDs field and click OK
5. Double-click any Event ID 4750 entry to view details
6. Review the following key fields:
   • Subject Account Name: Who performed the password change
   • Target Account Name: Which computer account was modified
   • Target Domain: Domain containing the computer account
   • Logon ID: Session identifier for correlation

Use PowerShell to query and analyze Event ID 4750 occurrences across your environment:

# Get recent computer account password changes
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4750} -MaxEvents 50 | 
    Select-Object TimeCreated, @{Name='Computer';Expression={$_.Properties[0].Value}}, 
    @{Name='Subject';Expression={$_.Properties[1].Value}} | Format-Table -AutoSize

# Filter for specific computer account
$ComputerName = "WORKSTATION01$"
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4750} | 
    Where-Object {$_.Properties[0].Value -like "*$ComputerName*"} | 
    Select-Object TimeCreated, Message

# Check for manual password changes (non-computer account subjects)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4750} -MaxEvents 100 | 
    Where-Object {$_.Properties[1].Value -notlike "*$"} | 
    Format-List TimeCreated, @{Name='Target';Expression={$_.Properties[0].Value}}, 
    @{Name='ChangedBy';Expression={$_.Properties[1].Value}}

For domain controllers, query multiple servers simultaneously:

$DomainControllers = @("DC01", "DC02", "DC03")
$Results = @()
foreach ($DC in $DomainControllers) {
    $Events = Get-WinEvent -ComputerName $DC -FilterHashtable @{LogName='Security'; Id=4750} -MaxEvents 20 -ErrorAction SilentlyContinue
    $Results += $Events | Select-Object @{Name='DC';Expression={$DC}}, TimeCreated, @{Name='Computer';Expression={$_.Properties[0].Value}}
}
$Results | Sort-Object TimeCreated -Descending | Format-Table -AutoSize

Verify and adjust computer account password policy settings that control Event ID 4750 frequency:

1. Check current domain policy settings:

   # Query domain password policy
   Get-ADDefaultDomainPasswordPolicy | Select-Object MaxPasswordAge, MinPasswordAge
   
   # Check computer account password age setting
   $Domain = Get-ADDomain
   $DomainDN = $Domain.DistinguishedName
   Get-ADObject -Filter {objectClass -eq "domainDNS"} -SearchBase $DomainDN -Properties ms-DS-MachineAccountQuota, maxPwdAge

2. Review registry settings on domain controllers:

   # Check maximum password age (default 2592000 seconds = 30 days)
   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name MaximumPasswordAge -ErrorAction SilentlyContinue
   
   # Verify disable password change setting
   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name DisablePasswordChange -ErrorAction SilentlyContinue

3. For specific computer accounts, check last password change:

   Get-ADComputer -Identity "WORKSTATION01" -Properties PasswordLastSet, whenChanged | 
       Select-Object Name, PasswordLastSet, whenChanged, @{Name='DaysOld';Expression={(Get-Date) - $_.PasswordLastSet | Select-Object -ExpandProperty Days}}

Correlate Event ID 4750 with other security events to identify potential security issues:

1. Search for related authentication events:

   # Look for failed computer account authentications around password changes
   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   
   # Get computer account password changes
   $PasswordChanges = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4750; StartTime=$StartTime; EndTime=$EndTime}
   
   # Check for authentication failures (Event ID 4625) for the same accounts
   foreach ($Event in $PasswordChanges) {
       $ComputerAccount = $Event.Properties[0].Value
       $ChangeTime = $Event.TimeCreated
       
       $AuthFailures = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$ChangeTime.AddHours(-2); EndTime=$ChangeTime.AddHours(2)} | 
           Where-Object {$_.Properties[5].Value -eq $ComputerAccount}
       
       if ($AuthFailures) {
           Write-Output "Potential issue with $ComputerAccount at $ChangeTime"
           $AuthFailures | Select-Object TimeCreated, @{Name='FailureReason';Expression={$_.Properties[8].Value}}
       }
   }

2. Check for unusual password change patterns:

   # Identify computers with frequent password changes (potential security issue)
   $RecentChanges = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4750; StartTime=(Get-Date).AddDays(-30)}
   $ChangesByComputer = $RecentChanges | Group-Object {$_.Properties[0].Value} | 
       Where-Object {$_.Count -gt 5} | 
       Select-Object Name, Count, @{Name='LastChange';Expression={($_.Group | Sort-Object TimeCreated -Descending)[0].TimeCreated}}
   
   $ChangesByComputer | Format-Table -AutoSize

3. Verify trust relationships for affected computers:

   # Test secure channel for computers with recent password changes
   $ComputerNames = $PasswordChanges | ForEach-Object {($_.Properties[0].Value -replace '\$$', '')}
   foreach ($Computer in $ComputerNames) {
       try {
           $TrustTest = Test-ComputerSecureChannel -ComputerName $Computer -ErrorAction Stop
           Write-Output "$Computer`: Trust OK - $TrustTest"
       } catch {
           Write-Warning "$Computer`: Trust issue - $($_.Exception.Message)"
       }
   }

Set up comprehensive monitoring for Event ID 4750 to detect anomalies and security issues:

1. Create a custom Event Viewer view for computer account monitoring:
   • Open Event Viewer and right-click Custom Views
   • Select Create Custom View
   • Set Event level to Information
   • Enter 4750,4740,4767 in Event IDs (password change, account locked, password failed)
   • Set Event logs to Security
   • Name the view "Computer Account Security Events"
2. Configure PowerShell-based monitoring script:

   # Advanced monitoring script for computer account password changes
   param(
       [int]$MaxEvents = 100,
       [int]$AlertThreshold = 3,
       [string]$SMTPServer = "mail.company.com",
       [string]$AlertEmail = "security@company.com"
   )
   
   $StartTime = (Get-Date).AddHours(-1)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4750; StartTime=$StartTime} -MaxEvents $MaxEvents -ErrorAction SilentlyContinue
   
   if ($Events) {
       # Group by computer and check for excessive changes
       $SuspiciousActivity = $Events | Group-Object {$_.Properties[0].Value} | 
           Where-Object {$_.Count -ge $AlertThreshold}
       
       if ($SuspiciousActivity) {
           $AlertBody = "Suspicious computer account password activity detected:`n`n"
           foreach ($Activity in $SuspiciousActivity) {
               $AlertBody += "Computer: $($Activity.Name) - $($Activity.Count) password changes in last hour`n"
           }
           
           # Send alert email (configure SMTP settings as needed)
           Send-MailMessage -To $AlertEmail -From "monitoring@company.com" -Subject "Computer Account Security Alert" -Body $AlertBody -SmtpServer $SMTPServer
       }
       
       # Log summary to Windows Event Log
       $EventCount = $Events.Count
       Write-EventLog -LogName Application -Source "Computer Account Monitor" -EventId 1001 -EntryType Information -Message "Processed $EventCount computer account password changes in the last hour"
   }

3. Set up Windows Task Scheduler to run the monitoring script:

   # Create scheduled task for monitoring
   $TaskName = "Computer Account Password Monitor"
   $ScriptPath = "C:\Scripts\ComputerAccountMonitor.ps1"
   
   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File `"$ScriptPath`""
   $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   
   Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM" -RunLevel Highest