Windows Event ID 4762 – Security: User Account Enabled

Start by examining the specific event details to understand who enabled the account and from where:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4762 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4762 in the Event IDs field and click OK
5. Double-click the event to view detailed information including:
   • Subject: Administrator who performed the action
   • Target Account: User account that was enabled
   • Logon ID: Session identifier for correlation
   • Workstation Name: Source computer for the operation

Use PowerShell to efficiently search and analyze Event ID 4762 occurrences across your environment:

1. Open PowerShell as Administrator
2. Query recent account enablement events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4762} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events for specific user accounts:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4762} | Where-Object {$_.Message -like '*TargetUserName*'} | Format-Table TimeCreated, Message -Wrap

4. Export events for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4762} | Export-Csv -Path "C:\Temp\AccountEnabled_Events.csv" -NoTypeInformation

5. Query remote domain controllers:

   Invoke-Command -ComputerName DC01,DC02 -ScriptBlock {Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4762} -MaxEvents 10}

Verify the current account status and recent changes using Active Directory administrative tools:

1. Open Active Directory Users and Computers from Administrative Tools
2. Navigate to the organizational unit containing the target user account
3. Right-click the user account and select Properties
4. Check the Account tab to verify current account status and settings
5. Use PowerShell to query account details:

   Get-ADUser -Identity "username" -Properties Enabled, LastLogonDate, PasswordLastSet, WhenChanged | Format-List

6. Review account modification history:

   Get-ADUser -Identity "username" -Properties * | Select-Object Name, Enabled, WhenCreated, WhenChanged, ModifiedCount

7. Check for recent password changes that might correlate with account enablement:

   Search-ADAccount -AccountDisabled | Where-Object {$_.PasswordLastSet -gt (Get-Date).AddDays(-7)}

Implement comprehensive monitoring to track future account enablement events and establish security baselines:

1. Configure Advanced Audit Policy using Group Policy:
   • Open Group Policy Management Console
   • Edit the appropriate GPO and navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Enable Audit User Account Management for both Success and Failure
2. Set up PowerShell monitoring script:

   # Create monitoring script for Event ID 4762
   $Action = {
       $Event = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4762} -MaxEvents 1
       $Message = "Account Enabled: " + $Event.Message
       Write-EventLog -LogName Application -Source "Security Monitor" -EventId 1001 -Message $Message
   }
   Register-WMIEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4762" -Action $Action

3. Configure Windows Event Forwarding (WEF) for centralized collection:

   winrm quickconfig
   wecutil cs subscription.xml

4. Create custom XML subscription file for Event ID 4762 collection targeting domain controllers and critical servers

Establish enterprise-level monitoring and alerting for Event ID 4762 through SIEM integration:

1. Configure Windows Event Collection service on collector servers:

   Start-Service Wecsvc
   Set-Service Wecsvc -StartupType Automatic

2. Create custom detection rules in your SIEM platform for Event ID 4762 patterns:
   • Multiple account enablements from single administrator session
   • Account enablement outside business hours
   • Privileged account enablement by non-authorized personnel
   • Bulk account enablement operations
3. Set up automated correlation with other security events:

   # PowerShell script for event correlation
   $EnableEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4762; StartTime=(Get-Date).AddHours(-1)}
   $LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-1)}
   # Correlate events by LogonId for comprehensive session analysis

4. Configure alerting thresholds and notification channels for security team response
5. Implement automated response workflows for high-risk scenarios like privileged account enablement
6. Create compliance reports combining Event ID 4762 with related account management events (4720, 4722, 4725, 4767)