Windows Event ID 4758 – Microsoft-Windows-Security-Auditing: User Account Enabled

Start by examining the specific details of Event ID 4758 to understand the context of the account enabling action.

1. Open Event Viewer by pressing Windows + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4758 in the Event IDs field and click OK
5. Double-click on a 4758 event to view detailed information
6. Review the General tab for basic event information and timestamp
7. Click the Details tab and select XML View for structured data
8. Document the following key fields:
   • Subject: The account that performed the enabling action
   • Target Account: The account that was enabled
   • Logon ID: Session identifier for correlation with logon events
   • Process Information: The tool or process used to enable the account

Use PowerShell to efficiently query and analyze Event ID 4758 occurrences across your environment.

1. Open PowerShell as Administrator
2. Query recent account enabling events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4758} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4758; StartTime=$StartTime; EndTime=$EndTime}

4. Extract detailed event properties:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4758} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           TargetUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           TargetDomainName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetDomainName'} | Select-Object -ExpandProperty '#text'
       }
   }

5. Export results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4758} | Export-Csv -Path "C:\Temp\AccountEnabled_Events.csv" -NoTypeInformation

Investigate the Active Directory context and verify the account enabling action through directory services logs.

1. Check the Directory Service log for related events:

   Get-WinEvent -FilterHashtable @{LogName='Directory Service'; StartTime=(Get-Date).AddHours(-1)} | Where-Object {$_.Message -like '*account*'}

2. Query Active Directory for current account status:

   Import-Module ActiveDirectory
   $TargetUser = "username_from_event"
   Get-ADUser -Identity $TargetUser -Properties Enabled, whenChanged, whenCreated, LastLogonDate | Format-List Name, Enabled, whenChanged, whenCreated, LastLogonDate

3. Review account modification history:

   Get-ADUser -Identity $TargetUser -Properties * | Select-Object Name, whenChanged, modifyTimeStamp, uSNChanged

4. Check for recent password changes that might be related:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4724} | Where-Object {$_.Message -like "*$TargetUser*"} | Select-Object TimeCreated, Message

5. Verify group membership changes around the same time:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728,4732,4756} | Where-Object {$_.Message -like "*$TargetUser*"} | Format-Table TimeCreated, Id, Message -Wrap

Set up proactive monitoring to detect and alert on future account enabling activities for security oversight.

1. Create a custom Event Viewer view for ongoing monitoring:
   • In Event Viewer, right-click Custom Views and select Create Custom View
   • Select By log and choose Security
   • Enter 4758 in the Event IDs field
   • Name the view "Account Enabled Events" and save
2. Configure Windows Event Forwarding (WEF) for centralized collection:

   # On collector server
   wecutil qc /q
   # Create subscription
   wecutil cs AccountEnabledSubscription.xml

3. Set up PowerShell-based monitoring script:

   # Monitor script to run as scheduled task
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4758; StartTime=(Get-Date).AddMinutes(-5)}
   if ($Events) {
       $Events | ForEach-Object {
           $Event = [xml]$_.ToXml()
           $Subject = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           $Target = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           Send-MailMessage -To "security@company.com" -Subject "Account Enabled Alert" -Body "User $Target was enabled by $Subject at $($_.TimeCreated)"
       }
   }

4. Configure audit policy to ensure events are generated:

   # Enable account management auditing
   auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

5. Create scheduled task for continuous monitoring:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\MonitorAccountEnabled.ps1"
   $Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
   Register-ScheduledTask -TaskName "Monitor Account Enabled" -Action $Action -Trigger $Trigger -RunLevel Highest

Perform comprehensive forensic analysis when Event ID 4758 indicates potential security incidents or policy violations.

1. Collect comprehensive event context using advanced PowerShell analysis:

   # Advanced event correlation script
   $TargetEvent = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4758} -MaxEvents 1
   $EventXML = [xml]$TargetEvent.ToXml()
   $LogonID = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectLogonId'} | Select-Object -ExpandProperty '#text'
   
   # Find related logon events
   $RelatedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | Where-Object {
       $LogonXML = [xml]$_.ToXml()
       $LogonXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetLogonId' -and $_.'#text' -eq $LogonID}
   }
   
   $RelatedLogons | Format-Table TimeCreated, Id, @{Name='SourceIP';Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'}}

2. Analyze process execution context:

   # Check for suspicious process names or paths
   $ProcessInfo = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
   Write-Host "Process used: $ProcessInfo"
   
   # Cross-reference with process creation events
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -like "*$ProcessInfo*"} | Select-Object TimeCreated, Message

3. Investigate privilege escalation patterns:

   # Check for privilege use events around the same time
   $TimeWindow = $TargetEvent.TimeCreated
   $StartTime = $TimeWindow.AddMinutes(-10)
   $EndTime = $TimeWindow.AddMinutes(10)
   
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672,4673,4674; StartTime=$StartTime; EndTime=$EndTime} | Format-Table TimeCreated, Id, Message -Wrap

4. Document findings and create incident response timeline:

   # Generate comprehensive incident report
   $Report = @{
       EventTime = $TargetEvent.TimeCreated
       EventID = $TargetEvent.Id
       SubjectUser = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       TargetUser = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       ProcessUsed = $ProcessInfo
       RelatedEvents = $RelatedLogons.Count
   }
   
   $Report | ConvertTo-Json | Out-File "C:\Temp\AccountEnabled_Investigation_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"

5. Implement immediate response actions if unauthorized:

   # If investigation reveals unauthorized access
   $UnauthorizedUser = "suspicious_account"
   
   # Disable the account immediately
   Disable-ADAccount -Identity $UnauthorizedUser
   
   # Force password reset
   Set-ADAccountPassword -Identity $UnauthorizedUser -Reset -NewPassword (ConvertTo-SecureString "TempPassword123!" -AsPlainText -Force)
   
   # Log the response action
   Write-EventLog -LogName Application -Source "Security Response" -EventId 1001 -Message "Account $UnauthorizedUser disabled due to unauthorized enabling detected in Event ID 4758 investigation"