ZEKASTRA

SecurityAccount management

4738 · A user account was changed

Generated each time a user object is changed. Changed attributes carry their new values; unchanged ones show "-".

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • SamAccountName
  • UserPrincipalName
  • PasswordLastSet
  • AccountExpires
  • PrimaryGroupId
  • AllowedToDelegateTo
  • OldUacValue
  • NewUacValue
  • UserAccountControl
  • SidHistory
  • LogonHours

02How to use it

Compare OldUacValue and NewUacValue for flags such as "Don't Require Preauth" or "Password Not Required"; non-empty SidHistory or AllowedToDelegateTo changes deserve review.

03Caveats

Requires Audit User Account Management. Some changes (for example DACL changes) appear with all attributes as "-", and some changes produce no 4738 at all.

05Sources

  1. Microsoft Learn — 4738(S) A user account was changed checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.